EUVD-2026-44212
GHSA-vm6w-v59c-562f
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Exploitation requires local file open with user interaction (AV:L, UI:R); no OS privileges needed; truncation only leaks data with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
AnalysisAI
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a maliciously crafted document, exposing potentially sensitive memory contents with high confidentiality impact (C:H). The vulnerability spans a broad range of Microsoft Office and SharePoint products - including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Word 2016, Office 2019, Office 365 for Mac, and multiple SharePoint Server versions. No public exploit identified at time of analysis; CISA SSVC rates exploitation as none, EPSS stands at 0.39% (31st percentile), and a vendor-released patch is available from Microsoft.
Technical ContextAI
CWE-197 (Numeric Truncation Error) occurs when a numeric value is implicitly or explicitly narrowed during a type cast or arithmetic operation, causing data loss or an incorrect boundary calculation. In a document parser context, this commonly manifests as an integer truncation that produces a value smaller than the true size of a data structure, leading the parser to read from or expose memory regions beyond intended bounds - resulting in an information leak. The CPE data confirms affected products across two families: the Office productivity suite (cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_office_2019, microsoft_office_365_for_mac, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, microsoft_word_2016) and the SharePoint server platform (microsoft_sharepoint_enterprise_server_2016, microsoft_sharepoint_server_2019, microsoft_sharepoint_server_subscription_edition). The presence of SharePoint in the CPE list suggests the vulnerability may also surface in server-side document rendering or preview components, not exclusively in the desktop Word client.
RemediationAI
Apply the vendor-released patches immediately through your standard Office update channel. For SharePoint Enterprise Server 2016, update to build 16.0.5561.1001 or later; for SharePoint Server 2019, update to build 16.0.10417.20175 or later; for SharePoint Server Subscription Edition, update to build 16.0.19725.20434 or later; for Word 2016, update to build 16.0.5561.1000 or later; for Office 365 for Mac, update to build 16.111.26071215 or later. For Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 2019, apply available updates via https://aka.ms/OfficeSecurityReleases. If patching is temporarily delayed for Click-to-Run products, a compensating control is to configure Protected View to open all documents from external or untrusted sources in read-only mode - this adds a user-confirmation step before the document parser fully processes content, reducing attack surface; note this does not eliminate the vulnerability and may reduce workflow productivity for users who regularly open external documents. Full advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55142.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-197 – Numeric Truncation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today