EUVD-2026-44182
GHSA-j8mh-3pf8-6q5p
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file-open trigger (AV:L, UI:R), no attacker privileges needed (PR:N), memory read-only disclosure with no write or crash impact (C:H/I:N/A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Office Word and associated Microsoft 365 products allows local information disclosure when a user opens a specially crafted document. Affecting a broad range of Microsoft Office versions across Windows and macOS - including Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and SharePoint Server 2016/2019/Subscription Edition - an attacker with no prior system privileges must socially engineer a victim into opening a malicious file to trigger memory disclosure. No public exploit identified at time of analysis; EPSS is 0.39% (31st percentile) and SSVC confirms exploitation status as none and the attack as non-automatable.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) identifies the root cause: the Word document parser reads data beyond the boundaries of an allocated memory buffer when processing a maliciously crafted file, exposing adjacent process memory. This class of flaw commonly arises in complex document format parsers - such as those handling legacy .doc, .rtf, or Office Open XML structures - where length or bounds validation is absent or insufficient. The breadth of the CPE data (cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, cpe:2.3:a:microsoft:microsoft_office_2019, cpe:2.3:a:microsoft:microsoft_office_ltsc_2021, cpe:2.3:a:microsoft:microsoft_office_ltsc_2024, cpe:2.3:a:microsoft:microsoft_office_365_for_mac, cpe:2.3:a:microsoft:microsoft_office_ltsc_for_mac_2021, cpe:2.3:a:microsoft:microsoft_office_ltsc_for_mac_2024, cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, cpe:2.3:a:microsoft:microsoft_sharepoint_server_2019, cpe:2.3:a:microsoft:microsoft_sharepoint_server_subscription_edition) indicates the vulnerable parsing code is shared across multiple product lines and also surfaces in server-side SharePoint document processing pipelines, extending the attack surface beyond the desktop Word client.
RemediationAI
Apply Microsoft's security update via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55050. Specific confirmed fixed builds include: Microsoft Office 365 for Mac, LTSC for Mac 2021, and LTSC for Mac 2024 updated to version 16.111.26071215 or later; Microsoft Word 2016 updated to 16.0.5561.1000 or later; Microsoft SharePoint Enterprise Server 2016 updated to 16.0.5561.1001 or later; Microsoft SharePoint Server 2019 updated to 16.0.10417.20175 or later; Microsoft SharePoint Server Subscription Edition updated to 16.0.19725.20434 or later. For Windows-based Microsoft 365 Apps for Enterprise, Office 2019, LTSC 2021, and LTSC 2024, apply updates per https://aka.ms/OfficeSecurityReleases. As a compensating control pending patching, enforce Protected View for documents received from external sources via Group Policy (Office hardening baseline), which prevents full document parsing and would block this attack vector at the cost of requiring users to manually enable editing for legitimate external documents. Restricting SharePoint's server-side document preview and conversion features reduces exposure on the server side until SharePoint patches are applied.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today