EUVD-2026-56696
GHSA-qccf-jxm6-539r
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local vector confirmed by document-open trigger; PR:N as no system privileges needed; UI:R mandatory; C:H for memory disclosure; no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Office Word's document parser enables local information disclosure across Windows and Mac product lines, including Office 2016, 2019, 2021, 2024 LTSC, and Microsoft 365 Apps. An attacker who supplies a crafted Word document can cause the application to read beyond allocated memory boundaries, leaking high-confidence memory contents to the attacker. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, though the broad affected product surface and low attack complexity make it a credible phishing delivery vehicle.
Technical ContextAI
CWE-125 (Out-of-bounds Read) describes a class of memory safety flaw in which a program reads data past the end of an intended buffer. In Microsoft Word's document parsing subsystem, a malformed file structure can cause the parser to reference memory outside its allocated region, exposing adjacent heap or stack contents. The CVSS vector AV:L confirms execution occurs in the local process context - the document must be rendered by the Word application. Affected CPE targets span multiple Office release trains: Office 2016 (build 16.0.1-16.0.5565.1000), Office 2019 (19.0.0+), Office LTSC 2021 and 2024 (Windows and Mac), and Microsoft 365 Apps for Enterprise (16.0.1+), as enumerated in the EUVD-2026-56696 advisory. The Mac builds have a concrete fixed version: 16.112.26081010.
RemediationAI
The primary remediation is applying the vendor-released patch via Microsoft Update or the Office deployment toolchain. For Mac builds, the confirmed fixed version is 16.112.26081010 (applicable to Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office 365 for Mac). For Windows builds of Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise, apply updates referenced at https://aka.ms/OfficeSecurityReleases. For Microsoft Word 2016, update to build 16.0.5565.1000 or later. Organizations unable to patch immediately should consider enabling Protected View for documents received from the internet or email, which sandboxes document rendering and limits the parser's ability to trigger the out-of-bounds read - note that Protected View may interfere with macro-enabled workflows. Disabling automatic document preview in file explorers and email clients reduces passive exposure. Full advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63530.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today