EUVD-2026-44168
GHSA-jh8v-577q-58w5
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file-parse trigger with mandatory user interaction; no auth needed to open a file; confidentiality-only impact consistent with out-of-bounds read memory disclosure.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read (CWE-125) in Microsoft Office's file parsing logic exposes potentially sensitive in-memory data to a local attacker when a victim opens a specially crafted document, affecting Windows and macOS Office editions as well as Microsoft SharePoint Server. The CVSS 5.5 Medium score reflects a local-only attack vector with mandatory user interaction, confining impact to information disclosure with no integrity or availability consequence. No public exploit code exists, CISA SSVC classifies exploitation as 'none' with no automation potential, and the EPSS of 0.51% (40th percentile) confirms low current exploitation probability.
Technical ContextAI
CWE-125 (Out-of-bounds Read) describes a memory safety flaw where a program reads data beyond the boundary of an allocated buffer, potentially revealing adjacent memory contents such as heap data, stack frames, or neighboring object fields. The flaw resides in Microsoft Office's document parsing subsystem - a broad attack surface common to file-format processing in Word, Excel, PowerPoint, and SharePoint document libraries. CPE strings confirm impact across cpe:2.3:a:microsoft:microsoft_office_2016, cpe:2.3:a:microsoft:microsoft_office_2019, cpe:2.3:a:microsoft:microsoft_office_ltsc_2021, cpe:2.3:a:microsoft:microsoft_office_ltsc_2024, cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, cpe:2.3:a:microsoft:microsoft_office_365_for_mac, cpe:2.3:a:microsoft:microsoft_office_ltsc_for_mac_2021, cpe:2.3:a:microsoft:microsoft_office_ltsc_for_mac_2024, cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, and cpe:2.3:a:microsoft:microsoft_sharepoint_server_2019. The inclusion of SharePoint suggests the parser vulnerability may be triggered server-side via document upload or preview workflows, though the AV:L vendor scoring implies the primary exploitation path is local file opening.
RemediationAI
Apply Microsoft's released patches for all affected products as the primary fix. For SharePoint Enterprise Server 2016, update to build 16.0.5561.1001 or later. For SharePoint Server 2019, update to 16.0.10417.20175 or later. For SharePoint Server Subscription Edition, update to 16.0.19725.20434 or later. For macOS editions (Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024), update to build 16.111.26071215 or later. For all Windows Office editions (2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise), apply the updates available via https://aka.ms/OfficeSecurityReleases. The full Microsoft Security Response Center advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55023. Where immediate patching is not possible, configuring Office Protected View to prevent automatic processing of externally received files reduces exposure by requiring an additional user step before the vulnerable parser is invoked - note this does not block exploitation if users click through Protected View warnings. Restricting SharePoint document upload permissions for untrusted users is a targeted compensating control for the server-side attack surface.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today