EUVD-2026-56429
GHSA-pc5m-wcc8-vwh5
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open trigger requires user interaction but no system privileges; full impact on victim system with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
AnalysisAI
Heap-based buffer overflow in Microsoft Office enables local code execution when a user opens a specially crafted document, affecting multiple product lines including Office 2016 through Microsoft 365 Apps for Enterprise. The vulnerability carries a CVSS 7.8 (High) score and achieves full confidentiality, integrity, and availability compromise on the victim system. No public exploit code has been identified at time of analysis, and Microsoft has released patches via the standard Office Security Releases channel.
Technical ContextAI
CWE-122 (Heap-based Buffer Overflow) describes a condition where a program writes data beyond the bounds of a heap-allocated memory region, enabling attackers to corrupt adjacent heap structures and redirect execution flow. In the Microsoft Office context, this class of flaw typically resides in document-format parsers - components that process binary or structured file formats such as .doc, .xls, or .ppt - where malformed field lengths or record sizes cause unbounded writes into the heap. The CVSS vector AV:L/AC:L/PR:N/UI:R confirms the attack surface is the local file-parsing path triggered by user-initiated document opening, rather than a network-exposed service. Affected CPE surfaces span Office 2016 (16.0.x), Office 2019 (19.0.x), Office LTSC 2021 (16.0.1+), Office LTSC 2024 (16.0.0+), and Microsoft 365 Apps for Enterprise (16.0.1+) as reported by EUVD-2026-56429.
RemediationAI
Apply the vendor-released patch via Microsoft Update or the Office Security Releases page at https://aka.ms/OfficeSecurityReleases. For Office 2016, the fixed version is confirmed at 16.0.5565.1001; for all other affected product lines (Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise), apply the latest update available through https://aka.ms/OfficeSecurityReleases as exact fixed build numbers were not individually enumerated in the available data. Organizations that cannot patch immediately should enforce Protected View policies to prevent automatic macro and content execution when opening documents from untrusted sources - note this does not prevent exploitation if users click through Protected View prompts. Additionally, disabling document-type file associations or restricting document opening from email attachments at the mail gateway level reduces exposure but impairs productivity. Block execution of Office applications spawning child processes via attack-surface-reduction rules in Microsoft Defender for Endpoint as a compensating control.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today