EUVD-2026-44216
GHSA-frx9-7h8f-gr63
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local vector and required user interaction confirmed by description; no privileges needed to craft the document; confidentiality impact only, no integrity or availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Uninitialized memory disclosure in Microsoft Office exposes sensitive data locally when a user interacts with a crafted document. The vulnerability, rooted in CWE-908 (Use of Uninitialized Resource), affects the full breadth of current Office deployments across Windows and macOS, including Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, and SSVC signals confirm no observed exploitation; however, the High confidentiality impact warrants prompt patching given Office's ubiquitous deployment footprint.
Technical ContextAI
CWE-908 (Use of Uninitialized Resource) describes a class of memory-safety defect in which software reads or otherwise operates on a memory region before it has been properly initialized, potentially exposing whatever data previously occupied that memory - heap spray remnants, cryptographic material, credentials, or other process-resident secrets. In Microsoft Office, document parsing pipelines routinely allocate buffers to process complex file formats (OOXML, OLE, RTF, etc.); failure to zero-initialize or fully populate a buffer before use can cause its raw memory contents to be embedded in output, rendered to screen, or transmitted. The CPE data confirms affected products span cpe:2.3:a:microsoft:microsoft_office_2016, microsoft_office_2019, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, microsoft_365_apps_for_enterprise, microsoft_office_365_for_mac, microsoft_office_ltsc_for_mac_2021, and microsoft_office_ltsc_for_mac_2024, covering both the perpetual-license and subscription-based Office families on Windows and macOS.
RemediationAI
Apply the vendor-released patch through standard Microsoft Update channels; the authoritative advisory is published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55042. For Microsoft 365 Apps for Enterprise and Office 365 for Mac, the patch will be delivered via Monthly Channel or Current Channel updates - organizations on Semi-Annual Channel should verify their scheduled update window. For perpetual-license products (Office 2016, 2019, LTSC 2021, LTSC 2024), apply the relevant cumulative update for Office. Exact patched build numbers are not independently confirmed from available data - verify through the MSRC advisory. As a compensating control prior to patching, organizations may restrict execution of Office documents from untrusted sources via Attack Surface Reduction (ASR) rules or Protected View policies enforced through Group Policy, though this limits document functionality for end users.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today