EUVD-2026-44178
GHSA-mv79-47jw-w96q
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file-open is the attack trigger (AV:L, UI:R); no attacker privileges needed (PR:N); only confidentiality is impacted via memory read; no integrity or availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds memory read in Microsoft Office and SharePoint exposes sensitive in-process data when a user opens a specially crafted document on a local machine. Affecting Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024 (Windows and macOS), and SharePoint Server 2016 through Subscription Edition, the CWE-125 flaw allows an unauthorized attacker to read beyond allocated buffer boundaries, achieving High confidentiality impact with no integrity or availability consequence. No public exploit exists and no active exploitation is confirmed at time of analysis - CISA SSVC rates exploitation status as none - making this a routine-priority patch despite the broad product coverage.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) occurs when a parser or data-processing routine trusts attacker-controlled length or offset fields without adequate bounds checking, causing it to read memory outside the intended buffer. In Office document parsers, this typically arises when processing malformed record structures embedded in file formats such as .docx, .xlsx, or .pptx. The CVSS local attack vector (AV:L) confirms that exploitation occurs on the victim's own system during document processing, not via a direct network channel. Scope is Unchanged (S:U), meaning the memory disclosure is contained within the Office application process. CPE data confirms affected products span both Windows and macOS platforms: cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_office_2016, microsoft_office_2019, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, microsoft_office_365_for_mac, microsoft_office_ltsc_for_mac_2021, microsoft_office_ltsc_for_mac_2024, microsoft_sharepoint_enterprise_server_2016, and microsoft_sharepoint_server_2019. The inclusion of SharePoint server products alongside desktop Office suggests the vulnerable parsing component may be shared across the Microsoft Office platform SDK.
RemediationAI
Apply the vendor-released patches confirmed by Microsoft MSRC and EUVD-2026-44178. For Microsoft Office 2016, update to build 16.0.5561.1000 or later; for SharePoint Enterprise Server 2016, update to 16.0.5561.1001 or later; for SharePoint Server 2019, update to 16.0.10417.20175 or later; for SharePoint Server Subscription Edition, update to 16.0.19725.20434 or later. For Microsoft Office 365 for Mac, LTSC for Mac 2021, and LTSC for Mac 2024, update to build 16.111.26071215 or later. For Microsoft Office 2019, LTSC 2021, LTSC 2024, and 365 Apps for Enterprise (Windows), apply the current release via the Microsoft 365 update channel referenced at https://aka.ms/OfficeSecurityReleases - specific build numbers for these products were not independently confirmed from the available data. The vendor advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55028. If immediate patching is not feasible, ensure Office Protected View is enabled for files originating from the internet or email (the default in most enterprise configurations), which adds an interaction barrier before full document parsing occurs; note that this does not prevent exploitation if a user explicitly enables editing. Restricting macro execution and external content via Group Policy provides defense-in-depth but does not address the underlying parser flaw.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today