EUVD-2026-44248
GHSA-qxgq-qrj7-v4gg
Severity by source
Sources disagree (Low–High)AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Local malicious-file delivery with required user interaction and no auth; an out-of-bounds read yields high confidentiality disclosure only, so I and A are N.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) arises from an out-of-bounds read (CWE-125) that lets an attacker who convinces a victim to open a crafted file read memory beyond an intended buffer boundary. Exploitation is local and requires user interaction, and there is no public exploit identified at time of analysis and no CISA KEV listing. Disclosed memory can leak sensitive data such as heap contents or pointer addresses useful for defeating ASLR in a follow-on exploit chain.
Technical ContextAI
The flaw is a CWE-125 out-of-bounds read within Microsoft Office's file-format parsing code. When Office parses a maliciously crafted document, a length or index field is trusted without adequate bounds checking, causing a read past the end of an allocated buffer. CPE data confirms the affected code is shared across the Office family: microsoft_365_apps_for_enterprise, microsoft_office_2016, microsoft_office_2019, microsoft_office_365_for_mac, and microsoft_office_ltsc_2021/2024 (including the for_mac 2021/2024 variants), indicating the vulnerable parser is present in both Windows and macOS builds. Out-of-bounds reads of this class typically leak adjacent heap/stack memory rather than corrupting it, which is why the primary impact is information disclosure.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50665 for each affected channel (Microsoft 365 Apps via Click-to-Run, the monthly security update for Office 2016/2019 and Office LTSC 2021/2024, and the corresponding Office for Mac update). The provided data does not include exact fixed build numbers, so pull them from the MSRC update guide for your specific channel. As compensating controls until patching, open untrusted documents in Protected View / Application Guard to sandbox the parser, block or restrict inbound Office attachments from untrusted sources at the mail gateway, and enforce 'block macros/content from the Internet' policies; the trade-off is reduced usability for legitimate external documents and Protected View does not guarantee the OOB read path is unreachable, so patching remains the definitive fix.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today