Skip to main content

Microsoft Word CVE-2026-66806

| EUVDEUVD-2026-56748 MEDIUM
Out-of-bounds Read (CWE-125)
2026-08-11 secure@microsoft.com GHSA-vr2p-489v-8hm2
Information Disclosure Buffer Overflow Microsoft 365 Apps Office 2019 Office 2021 Office 2024 Word Red Hat
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
ENISA EUVD
HIGH
qualitative
vuln.today AI
5.5 MEDIUM

Local file-open trigger (AV:L, UI:R), no privilege required; confidentiality-only impact with no integrity or availability effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Red Hat
7.4 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
Analysis Generated
Aug 11, 2026 - 22:14 vuln.today
Patch available
Aug 11, 2026 - 18:19 EUVD
CVE Published
Aug 11, 2026 - 17:19 nvd
MEDIUM 5.5

DescriptionNVD

Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

AnalysisAI

Information disclosure in Microsoft Word via an off-by-one out-of-bounds read (CWE-125) exposes high-confidentiality data to a local attacker when a user opens a crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft malicious Word document
Delivery
Deliver to target via email or link
Exploit
Target opens document
Execution
Off-by-one read leaks memory
Impact
Attacker recovers sensitive in-memory data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target user open a specially crafted Word document on an affected installation of Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, or Microsoft 365 Apps for Enterprise. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a moderate-severity local vulnerability: attack complexity is low and no privileges are required, but user interaction is mandatory and the attack vector is local, substantially limiting opportunistic exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker sends a target user a crafted Word document via email or a file-sharing link. When the user opens the document, Word's parser performs an off-by-one read beyond a buffer boundary, leaking adjacent memory contents - potentially including in-process credentials, cryptographic material, or sensitive document data - which the attacker can recover if they control the crafted file's output path. …
Remediation Apply the vendor-released patches immediately via Microsoft Update or the Microsoft Update Catalog. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in 365 Apps

View all
CVE-2024-21413 CRITICAL POC
9.8 Feb 13

Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
CVE-2021-42292 HIGH
7.8 Nov 10

Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
CVE-2023-21715 HIGH
7.3 Feb 14

Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
CVE-2026-21509 HIGH POC
7.8 Jan 26

Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
CVE-2026-21514 HIGH
7.8 Feb 10

Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
CVE-2021-38646 HIGH
7.8 Sep 15

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
CVE-2021-34478 HIGH
7.8 Aug 12

Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
CVE-2021-34501 HIGH
7.8 Jul 14

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
CVE-2025-47957 HIGH POC
8.4 Jun 10

Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary

CVE-2022-41106 HIGH
8.8 Nov 09

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
CVE-2023-33148 HIGH POC
7.8 Jul 11

Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack

CVE-2020-0901 CRITICAL
9.8 May 21

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

Share

CVE-2026-66806 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy