EUVD-2026-43756
GHSA-ch74-4vwm-9897
Severity by source
Sources disagree (Low–High)AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
File-borne local vector needing victim to open a document (AV:L/UI:R, PR:N); OOB read yields high confidentiality but at most a crash, so A:L and I:N.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) via an out-of-bounds read (CWE-125) lets an attacker leak sensitive memory contents when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.1 (AV:L/AC:L/PR:N/UI:R), reflecting local exploitation that requires user interaction but no prior authentication. Microsoft is the reporting source and has published a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
The flaw is a CWE-125 out-of-bounds read in one of the file-format parsers bundled with the Microsoft Office suite. Office applications parse complex binary and OOXML document structures; when a length or offset field in a crafted file is not properly validated, the parser reads memory beyond the bounds of the intended buffer. The CPE data confirms the affected code is shared across the desktop Office family: cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_office_2016, microsoft_office_2019, microsoft_office_365_for_mac, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, and the LTSC for Mac 2021/2024 builds - indicating a defect in a common parsing component rather than an app-specific bug. The 'Buffer Overflow' tag alongside 'Information Disclosure' aligns with the out-of-bounds-read root cause, where over-read memory is surfaced back to the attacker.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-56193 as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56193, which covers Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and the corresponding Office for Mac builds; the exact fixed build numbers are enumerated in that advisory and should be applied via your normal Windows/Microsoft AutoUpdate channel. Where immediate patching is not possible, reduce exposure by opening untrusted documents in Protected View and ensuring it is not disabled for internet- and email-originated files (trade-off: users must click to exit Protected View for legitimate editing), and by blocking or quarantining Office attachments from untrusted senders at the mail gateway (trade-off: may delay legitimate documents). Disabling the specific affected file-format handler is not advisable as a general control since the vulnerable component is not identified in the provided data.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today