EUVD-2026-44179
GHSA-3383-h2q9-8xq3
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local vector and required user interaction confirmed by file-open trigger; PR:N because attacker needs no account privileges, only file delivery; C:H for memory disclosure, no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Office exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a user to open a crafted document. The flaw affects a wide swath of Office and SharePoint products across Windows and Mac platforms, including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, Office 365 for Mac, and SharePoint Server 2016 through the Subscription Edition. No public exploit has been identified at time of analysis, EPSS is low at 0.50% (39th percentile), and CISA SSVC rates exploitation as none and the flaw as non-automatable, placing this firmly in a patch-and-monitor risk tier rather than an emergency-response tier.
Technical ContextAI
CWE-125 (Out-of-bounds Read) identifies the root cause: the Office file-parsing engine reads beyond the allocated buffer boundary when processing a specially crafted document, exposing adjacent heap or stack memory. This class of flaw arises from missing or insufficient bounds checks on user-controlled input lengths during parsing. CPE data confirms the affected surface spans both the Windows Office stack (Microsoft 365 Apps for Enterprise, Office 2016, 2019, LTSC 2021, LTSC 2024) and the macOS stack (Office 365 for Mac, LTSC for Mac 2021 and 2024), as well as the SharePoint Server product line (Enterprise Server 2016, Server 2019, and Subscription Edition), indicating a shared parsing component or library is likely at fault. Because the attack vector is local (AV:L) and requires user interaction (UI:R), exploitation depends on the victim opening a malicious file within an affected Office application rather than network-based delivery.
RemediationAI
Apply the vendor-released patches via standard Microsoft update channels. For Windows Office products (Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise), Microsoft directs administrators to https://aka.ms/OfficeSecurityReleases for the exact build numbers. Microsoft Office 2016 for Windows is patched at version 16.0.5561.1000 or later. On macOS, Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024 are all fixed at build 16.111.26071215 or later. SharePoint Enterprise Server 2016 is fixed at 16.0.5561.1001 or later, SharePoint Server 2019 at 16.0.10417.20175 or later, and SharePoint Server Subscription Edition at 16.0.19725.20434 or later. The authoritative patch guidance is published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55047. If patching is delayed, a practical compensating control is to configure Protected View or Mark of the Web policies via Group Policy to prevent automatic execution of document content from untrusted sources, which raises the bar for triggering the parser path - note this does not eliminate risk if users override Protected View prompts. No network-layer blocking is meaningful for this local-vector flaw.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today