EUVD-2026-44249
GHSA-cv5r-65fq-2r57
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file-open trigger (AV:L), user must open document (UI:R), no system privileges needed (PR:N); pure memory disclosure with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Office and SharePoint exposes process memory contents locally when a user opens a specially crafted document. Affected products span the full Office suite - Office 2016, 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise (Windows and Mac), and SharePoint Server 2016, 2019, and Subscription Edition - covering virtually the entire active Office install base. No public exploit code exists and CISA SSVC rates exploitation as none, making this a patch-and-monitor priority rather than an emergency response.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) describes a class of memory safety flaw where a parsing or processing routine reads beyond the allocated buffer boundary, exposing adjacent memory. In the Office context, this typically occurs in document format parsers (e.g., OLE compound document, OOXML, or rich-text handlers) when processing maliciously crafted field lengths or object sizes without adequate bounds validation. The CVSS AV:L vector confirms the vulnerability is triggered in-process when a file is opened locally, not via a network-exposed service. CPE strings confirm the vulnerable components span cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, cpe:2.3:a:microsoft:microsoft_office_2016 through cpe:2.3:a:microsoft:microsoft_office_ltsc_2024, and both Windows and Mac variants, as well as cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016 and cpe:2.3:a:microsoft:microsoft_sharepoint_server_2019, indicating the vulnerable parsing code is shared across the Office platform.
RemediationAI
The primary remediation is applying the vendor-released patch via Microsoft Update or the Microsoft 365 Admin Center. For Windows-based products, Office 2016 should be updated to build 16.0.5561.1000 or later and SharePoint Enterprise Server 2016 to 16.0.5561.1001 or later; SharePoint Server 2019 should reach 16.0.10417.20175 or later, and SharePoint Server Subscription Edition 16.0.19725.20434 or later. For Mac-based products (Office 365 for Mac, LTSC for Mac 2021 and 2024), update to version 16.111.26071215 or later. Cloud-serviced installations (Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise) should be updated via the release cadence at https://aka.ms/OfficeSecurityReleases. If immediate patching is not feasible, a compensating control is to configure Protected View or Attack Surface Reduction rules to prevent Office applications from processing files received from untrusted sources - this reduces the user-interaction attack surface but may impair document workflow for external file recipients. Full advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56192.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today