EUVD-2026-44188
GHSA-qp38-v3rr-p8rc
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AV:L because exploitation requires local file open; UI:R as victim must actively open the document; C:H for full in-memory data disclosure; I:N and A:N confirmed by description scope.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
AnalysisAI
Information disclosure in Microsoft Office Word and related Microsoft 365/SharePoint products exposes sensitive memory contents when a user opens a specially crafted document. Affecting a broad suite of products spanning Word 2016 through Office LTSC 2024 and SharePoint Server versions, the flaw stems from improper input type validation (CWE-1287) in the document parsing subsystem. No public exploit has been identified at time of analysis; EPSS at 0.39% and CISA SSVC exploitation status of 'none' confirm this remains a theoretical rather than actively targeted risk, though Microsoft has released patches.
Technical ContextAI
CWE-1287 (Improper Validation of Specified Type of Input) describes a class of flaw where a software component accepts data of an unexpected or incorrect type without enforcing strict type-checking, leading to unintended program behavior - in this case, local information disclosure. The affected component is the document parsing engine within Microsoft Office Word, which processes complex structured file formats such as .docx and .doc. The same vulnerable code path appears to be shared with Microsoft SharePoint's server-side document processing components, as evidenced by the CPE strings covering SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition alongside Word 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and both Windows and Mac variants. This breadth across products suggests the flaw resides in a shared document parsing library used across the Office and SharePoint ecosystems.
RemediationAI
Apply the vendor-released patches available through the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55124. Specific confirmed fix builds are: SharePoint Enterprise Server 2016 to build 16.0.5561.1001 or later, SharePoint Server 2019 to build 16.0.10417.20175 or later, SharePoint Server Subscription Edition to build 16.0.19725.20434 or later, Microsoft Word 2016 to build 16.0.5561.1000 or later, and all Mac Office products (Office 365 for Mac, LTSC for Mac 2021 and 2024) to build 16.111.26071215 or later. For Windows click-to-run products (Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise), the specific patched build versions are not enumerated in available data - consult https://aka.ms/OfficeSecurityReleases for current release information. As a compensating control prior to patching, ensure Protected View is enforced via Group Policy for documents received from the internet or email (this is default in most configurations but can be disabled by users). Disabling automatic preview or processing of untrusted documents in SharePoint document libraries can reduce server-side exposure pending the SharePoint patches.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today