EUVD-2026-44176
GHSA-fw98-4cg4-q8hf
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
File-based local trigger (AV:L), no attacker privileges needed (PR:N), mandatory user file-open (UI:R), and memory disclosure only (C:H/I:N/A:N) match the description exactly.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Office and SharePoint Server exposes local memory contents to an unauthorized attacker, resulting in information disclosure. The vulnerability (CWE-125) is triggered when a user opens a specially crafted Office document, making exploitation dependent on user interaction rather than remote network access. No active exploitation has been confirmed - CISA KEV does not list this CVE, SSVC rates exploitation as none, and EPSS probability sits at 0.51% (40th percentile), collectively indicating low real-world threat activity despite the wide deployment footprint of affected products.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) describes a memory safety defect in which a parsing routine reads beyond the bounds of an allocated buffer, potentially returning adjacent heap or stack memory to the caller or leaking it through application output. In Microsoft Office's document processing subsystem, this class of flaw typically resides in file format parsers (e.g., document, spreadsheet, or presentation handlers). The CVSS vector AV:L confirms exploitation occurs during local file parsing rather than over a network protocol. Affected products span the full Office suite: Microsoft 365 Apps for Enterprise (Windows Click-to-Run), Office 2016 (MSI), Office 2019, Office LTSC 2021 and 2024 (Windows and Mac), Office 365 for Mac, and the SharePoint server family (Enterprise Server 2016, Server 2019, Server Subscription Edition), as confirmed by CPE strings cpe:2.3:a:microsoft:microsoft_office_* and cpe:2.3:a:microsoft:microsoft_sharepoint_*.
RemediationAI
Apply the vendor-released patches as documented in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55027. Specific fix versions confirmed by EUVD: Office 2016 MSI update to 16.0.5561.1000 or later; SharePoint Enterprise Server 2016 to 16.0.5561.1001 or later; SharePoint Server 2019 to 16.0.10417.20175 or later; SharePoint Server Subscription Edition to 16.0.19725.20434 or later; Office LTSC for Mac 2021, Office 365 for Mac, and Office LTSC for Mac 2024 to build 16.111.26071215 or later. For Click-to-Run products (Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024 on Windows), apply the current channel release referenced at https://aka.ms/OfficeSecurityReleases via Microsoft Update or Configuration Manager. As a compensating control prior to patching, organizations can enforce Protected View or disable automatic file opening for untrusted documents via Group Policy (Disable 'Open in editing view' and enforce 'Mark Office files from the internet as unsafe'), which would prevent the UI:R trigger from executing the vulnerable code path - though this may impact user workflows for legitimate external documents.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today