EUVD-2026-99161
GHSA-4wmg-p3q7-xrh2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted rich text document to victim
-
DeliveryVictim opens or previews content
-
ExploitTrigger heap overflow in RichEdit parser
-
ExecutionCorrupt heap and hijack control flow
-
ImpactExecute arbitrary code in victim context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to process attacker-supplied rich text through the Windows Rich Text Edit Control - realistically, opening or previewing a crafted rich text document/message in an application that embeds RichEdit (legacy WordPad, Microsoft Office, Outlook, or Office for Mac builds listed in EUVD). The vendor's CVSS marks UI:N, but the document-rendering nature of the control means a user open/preview action is the most likely trigger, which limits spray-and-pray exploitation. Primary limiting factors: a vendor patch is already available; exploitation depends on the victim rendering attacker content in a RichEdit-backed application and on the specific unpatched build. |
| Impact | This is a genuinely high-priority flaw, though signals are mixed. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes unauthenticated, low-complexity, no-interaction network RCE with total CIA impact, and the SSVC decision framework corroborates severity (Technical Impact: total, Automatable: yes). However, SSVC Exploitation is 'none', there is no CISA KEV listing, and no EPSS probability was supplied - so there is currently no evidence of real-world exploitation, only high theoretical impact. A material tension exists: the component is the Windows Rich Text Edit Control (RichEdit), a document-rendering control, yet the vector asserts UI:N. For most RichEdit heap-overflow paths the target must open or preview attacker-supplied rich text, which realistically implies UI:R; verify with Microsoft whether an unattended preview/parsing path exists. Net: treat as a top-tier patch-now item given ubiquity and total impact, but note that absence of KEV/EPSS data and the UI:N-vs-document-rendering discrepancy mean active mass exploitation is not confirmed. |
| Exploit ScenarioDerived | An attacker crafts a malicious rich text document or message that, when opened or previewed in an application relying on the Windows Rich Text Edit Control (e.g., legacy WordPad, Office, or an Outlook preview path), triggers a heap-based buffer overflow in the control's parser. The overflow corrupts heap memory to achieve arbitrary code execution in the context of the victim process. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap-based buffer overflow in the Windows Rich Text Edit Control (RichEdit) allows remote attackers to execute arbitrary code in the context of the rendering application when a victim processes attacker-supplied rich text, without any authentication prerequisite per the CVSS vector (AV:N/AC:L/PR:N). Windows 10, Windows 11, Windows Server 2012 through 2025, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office for Mac are all listed as affected, so the exposure surface spans both the operating system and productivity applications that embed the control. Vendor patches are already available (MSRC advisory for CVE-2026-70096, EUVD-2026-99161), and no public exploit code or confirmed active exploitation has been identified at time of analysis - CISA's SSVC assessment records Exploitation: none while rating the flaw fully automatable with total technical impact, making pre-patch exposure the primary concern. Note that while the vendor vector marks UI:N, our independent assessment applies UI:R, because exploitation realistically requires the target to open or preview crafted rich text in a RichEdit-backed application, which constrains mass spray-and-pray campaigns.
RemediationAI
Vendor-released patch: apply the Microsoft security update for CVE-2026-70096, which raises affected systems to the fixed builds enumerated in EUVD - Windows 10 1607 to 10.0.14393.9612, Windows 10 1809 to 10.0.17763.9376, Windows 10 21H2/22H2 to 10.0.19044.7807, Windows 11 23H2 to 10.0.22631.7652, Windows 11 24H2 to 10.0.26100.9711, Windows 11 25H2 to 10.0.26200.9711, Windows 11 26H1 to 10.0.28000.3231, Windows 11 26H2 to 10.0.26300.9711, Server 2012 to 6.2.9200.26434, Server 2012 R2 to 6.3.9600.23470, Server 2016 to 10.0.14393.9612, Server 2019 to 10.0.17763.9376, Server 2022 to 10.0.20348.5761, and Server 2025 to 10.0.26100.33650. For Office, update Microsoft Office LTSC 2021 to 16.0.14334.20974, Office LTSC 2024 to 16.0.17932.21056, Microsoft 365 Apps for Enterprise via the current channel at https://aka.ms/OfficeSecurityReleases, and the Mac builds (Office LTSC for Mac 2021/2024 and Office 365 for Mac) through the Microsoft publication referenced by the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70096. Until every affected endpoint and Office channel is patched, apply compensating controls that target the rendering trigger: strip or quarantine RTF/rich-text attachments and disable automatic rich-text preview in email and collaboration gateways (this breaks legitimate RTF workflows and may increase helpdesk load), disable the Outlook preview pane and auto-open of received documents (degrades user convenience but removes the passive-render path), and enforce Mark-of-the-Web/Protected View or WordPad replacement policies so untrusted rich text cannot reach the RichEdit parsing path. Given the automatable rating and total technical impact in the SSVC assessment, prioritize internet-facing Remote Desktop and multi-session Windows Server hosts, plus Office installations that process mail or documents from external senders; these should be patched on an emergency cadence rather than a routine monthly cycle.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 22 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-122, a heap-based buffer overflow, in the Windows Rich Text Edit Control - the reusable RichEdit component (implemented in riched20.dll/msftedit.dll) that Windows and Office applications use to render and edit RTF and rich text content. RichEdit has a long history of parser-level memory-safety defects because its RTF and rich-text tokenizers perform size and copy arithmetic on attacker-controlled structure lengths and control words; when those calculations are wrong, an out-of-bounds write lands on the heap, and a well-formed heap layout can be converted into controlled code execution (C:H/I:H/A:H). The vulnerable parsing path is reachable from any application that hosts the control and parses untrusted content - legacy WordPad, Microsoft Office (Word, Outlook preview/message rendering), Microsoft 365 Apps for Enterprise, and the Office for Mac and Office LTSC builds enumerated in the EUVD data. Because the flaw lives in a shared system component rather than a single application, the same bug is reachable through document files, email bodies, and preview surfaces, which is why the affected-version list spans Windows 11 23H2/24H2/25H2/26H1/26H2, Windows 10 1607/1809/21H2/22H2, Windows Server 2012/2012 R2/2016/2019/2022/2025 (including Server Core), and the Office family. The EUVD ranges bound the fixed builds for each SKU, giving defenders a precise way to determine whether a host or Office channel is still vulnerable.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
RichEdit parses attacker-supplied rich text a user must open/preview, so UI:R; delivery is network-borne (AV:N), needs no privileges (PR:N), and a successful overflow yields full code execution (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.
Executive ViewAI
CVE-2026-70096 is a critical vulnerability in Microsoft's RichEdit control that affects Windows 10, Windows 11, Windows Server 2012 through 2025, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office for Mac, potentially allowing an unauthenticated attacker to execute code on an affected system when a crafted rich-text document is processed. Because the component is embedded across both operating systems and productivity applications, unpatched organizations face broad endpoint and Office-suite exposure that could lead to data compromise, lateral movement, or operational disruption. No public exploit identified at time of analysis, and patch status is Patch available per vendor advisory; leadership should therefore prioritize pre-patch exposure as the primary risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB