EUVD-2026-56689
GHSA-vf7p-72jw-ch4x
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file-based delivery requires victim interaction; no attacker privileges needed to craft the malicious document; impact is confidentiality-only with no integrity or availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to local attackers who can socially engineer a victim into opening a malicious document. Affected products span Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise across both Windows and macOS. No public exploit code is identified and SSVC rates exploitation as none, but the high confidentiality impact warrants timely patching for organizations whose users regularly handle documents from untrusted sources.
Technical ContextAI
CWE-125 (Out-of-bounds Read) identifies the root cause: Office's document parsing code reads beyond the end of an allocated buffer, leaking adjacent memory region contents. This is a read-side overrun, not a write overrun - exploitation leads to information disclosure rather than code execution, which is consistent with the zero integrity and availability impact in the CVSS vector. The 'Buffer Overflow' tag in the advisory metadata appears to be a loose categorization; the authoritative NVD and MSRC classification of CWE-125 takes precedence. Affected products confirmed via EUVD-2026-56689 include Office 2019 (build 19.0.0 baseline on Windows), Microsoft 365 Apps for Enterprise (build 16.0.1 baseline), Office LTSC 2021 and LTSC 2024 for Windows, and Office 365, LTSC 2021, and LTSC 2024 for macOS - all sharing the same underlying Office rendering and parsing components across both platforms.
RemediationAI
Apply the vendor-released patch as the primary fix. For all macOS editions (Office 365 for Mac, LTSC for Mac 2021, LTSC for Mac 2024), upgrade to version 16.112.26081010 or later - this is the exact confirmed fix version from EUVD-2026-56689. For all Windows editions (Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise), apply the latest cumulative update via Microsoft Update, Windows Update for Business, or the Office Deployment Tool; an exact fixed build number for Windows was not independently confirmable from the supplied data, so consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62842 and https://aka.ms/OfficeSecurityReleases directly for authoritative version details. If patching must be delayed, enforce Protected View policies via Group Policy (configure 'Open in Protected View' for files originating from the internet and unsafe locations) to sandbox document parsing and raise the interaction barrier - note that Protected View does not eliminate the underlying flaw but meaningfully limits exploitation opportunity. Additionally, Attack Surface Reduction rules in Microsoft Defender can block Office applications from loading untrusted content, though this may affect legitimate workflows and requires testing before deployment.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today