What is the CVSS score of CVE-2026-66806?

CVE-2026-66806 has a contested CVSS base score of 5.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-66806?

Yes, a patch is available for CVE-2026-66806. Update the affected software to the latest version immediately.

Microsoft Word CVE-2026-66806

EUVD-2026-56748 MEDIUM

Out-of-bounds Read (CWE-125)

2026-08-11 secure@microsoft.com

GHSA-vr2p-489v-8hm2

Buffer Overflow Information Disclosure Microsoft Red Hat 365 Apps Word Office 2021 Office 2024 Office 2019

Medium

Disputed · 5.5 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

ENISA EUVD

CRITICAL

qualitative

vuln.today AI

5.5 MEDIUM

Local file-open trigger (AV:L, UI:R), no privilege required; confidentiality-only impact with no integrity or availability effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

7.4 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:14 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:19 nvd

MEDIUM 5.5

DescriptionNVD

Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

AnalysisAI

Information disclosure in Microsoft Word via an off-by-one out-of-bounds read (CWE-125) exposes high-confidentiality data to a local attacker when a user opens a crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the high confidentiality impact and wide deployment footprint make patching a clear priority.

Technical ContextAI

CWE-125 (Out-of-bounds Read) describes a flaw where a program reads memory beyond the intended buffer boundary. In this case, an off-by-one arithmetic error in Word's document-parsing logic causes it to read one element past a valid buffer, leaking adjacent memory contents. The CVSS vector (AV:L) confirms the trigger is local - a user must open or interact with a malicious file. The affected CPE surface covers multiple Office release trains: Word 2016 (fixed at 16.0.5565.1000), and Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise (fix versions referenced via https://aka.ms/OfficeSecurityReleases). The tag 'Buffer Overflow' in the intelligence feed is slightly misleading - CWE-125 is a read-only overrun with no write primitive, limiting exploitation to information disclosure rather than code execution.

RemediationAI

Apply the vendor-released patches immediately via Microsoft Update or the Microsoft Update Catalog. For Microsoft Word 2016, update to build 16.0.5565.1000 or later. For Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024, apply the fixes documented at https://aka.ms/OfficeSecurityReleases and consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66806 for exact build numbers. As a compensating control while patching is in progress, organizations can configure Protected View in Office to open documents from untrusted sources in read-only sandboxed mode, which prevents the user interaction step required to trigger the flaw. Disabling the automatic preview of Office attachments in email clients (Outlook Reading Pane) also reduces the attack surface. These controls do not eliminate the vulnerability but raise the bar for exploitation.