EUVD-2026-56704
GHSA-2jmj-f42h-x4j9
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file-open trigger requires victim interaction (UI:R, AV:L); no system privileges needed by attacker (PR:N); impact is memory disclosure only, with no integrity or availability consequence.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds memory read in Microsoft Office exposes potentially sensitive process memory contents when a victim opens a specially crafted document locally. The vulnerability affects the full Office suite across Windows and macOS - spanning Office 2016 through LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise - with High confidentiality impact per CVSS but no integrity or availability consequence. No public exploit has been identified at time of analysis; CISA SSVC classifies exploitation status as none and the attack is not automatable, significantly reducing real-world prioritization urgency despite the High C rating.
Technical ContextAI
CWE-125 (Out-of-bounds Read) describes a class of memory safety flaw where a parser or processing routine reads past the end of an allocated buffer, exposing adjacent memory contents that may include sensitive data such as pointers, credentials, or document contents from other open processes. In Microsoft Office, the flaw resides in document parsing logic - when a crafted Office file is processed, the file parser indexes into memory beyond its allocated region. The affected products identified via EUVD span version ranges from 16.0.0 upward across Office 2016, 2019, 2021, and LTSC 2024 builds on Windows, and version 1.0.0 through below 16.112.26081010 on macOS for Office 365 for Mac, LTSC for Mac 2021, and LTSC for Mac 2024. The Windows fix boundary for Office 2016 is specifically identified as 16.0.5565.1001.
RemediationAI
The primary remediation is to apply Microsoft's released security update via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64899 or through the Office update channel at https://aka.ms/OfficeSecurityReleases. For macOS users, update to Office version 16.112.26081010 or later across Office 365 for Mac, LTSC for Mac 2021, and LTSC for Mac 2024. For Windows, Office 2016 users should update to at least build 16.0.5565.1001; other Windows versions should apply updates per the MSRC release cadence. Where immediate patching is not possible, a compensating control is to disable the opening of Office documents from untrusted or external sources using Protected View hardening (File → Options → Trust Center → Protected View - enable all three Protected View options). This will isolate document rendering in a sandboxed read-only mode and prevent the parser from executing with full application privileges, though it may interrupt workflows requiring macro or editing access from external documents.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today