EUVD-2026-44250
GHSA-pw4r-cm2r-6pph
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local vector with user interaction required to open a crafted file; no privileges needed; confidentiality-only impact consistent with an out-of-bounds read.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to a local, unauthenticated attacker who can induce a user to open a malicious document. Affected products span the full current Office portfolio - Office 2016 through LTSC 2024 on both Windows and macOS - making the blast radius broad despite the local attack vector. No public exploit identified at time of analysis and SSVC classifies exploitation as none and not automatable, though the high confidentiality impact (C:H) and near-universal deployment of Office keep this a meaningful patching priority.
Technical ContextAI
CWE-125 (Out-of-bounds Read) describes a condition where a program reads data beyond the end of an allocated buffer. In a document-processing application like Microsoft Office, this typically manifests in a file-format parser when a crafted input supplies a length or offset value that causes the parser to read memory outside the intended structure. The affected CPE strings confirm the flaw exists across cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, cpe:2.3:a:microsoft:microsoft_office_2016, cpe:2.3:a:microsoft:microsoft_office_2019, cpe:2.3:a:microsoft:microsoft_office_ltsc_2021, cpe:2.3:a:microsoft:microsoft_office_ltsc_2024, and their macOS counterparts (microsoft_office_365_for_mac, microsoft_office_ltsc_for_mac_2021, microsoft_office_ltsc_for_mac_2024). The scope is unchanged (S:U), meaning the out-of-bounds read is contained within the Office process boundary and does not directly break into the OS or another application - though leaked memory may contain credentials, tokens, or document content from that process.
RemediationAI
Apply the vendor-released patch through Microsoft Update, Windows Update for Business, or the Microsoft 365 admin center - the patch is confirmed available per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56195. The exact patched build version is not independently confirmed from the available input data; check the advisory directly for the specific KB article and build numbers. As a compensating control where immediate patching is not feasible, organizations can enable Office Protected View and disable macros for documents received from external sources, which would add an additional prompt layer before the malicious file is fully parsed - note this reduces user friction resistance rather than eliminating the vulnerability. Mark-of-the-Web enforcement (ensuring files downloaded from the internet are flagged and opened in Protected View) also raises the bar for exploitation without eliminating it.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today