EUVD-2026-99712
GHSA-7v9m-3jq8-8h6w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Word document to victim
-
DeliveryVictim opens malicious file
-
ExploitTrigger out-of-bounds read in parser
-
ExecutionLeak adjacent process memory
-
ImpactDisclose sensitive information to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open or preview an attacker-crafted Word document in an affected version of Microsoft Office Word (Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office for Mac builds below the patched versions). The required user interaction (UI:R) is the primary limiting factor - there is no serverless or automatic trigger; the attacker must socially engineer the victim into opening the malicious file. No authentication is required of the attacker (PR:N), and the affected parser is exercised in default configurations, so no special feature or non-default setting is needed beyond the victim opening the document. Impact is confined to information disclosure (confidentiality only). |
| Impact | Signals are consistently moderate and non-urgent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) shows a network-reachable, low-complexity, unauthenticated flaw, but it is gated by required user interaction (UI:R) and limited to confidentiality (C:H, no integrity or availability impact) - consistent with an out-of-bounds read (CWE-125) information-disclosure bug rather than code execution. CISA's SSVC assessment reinforces low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. There is no EPSS score, no CISA KEV listing, and no indication of public POC in the provided data, so there is no public exploit identified at time of analysis. The main tension is between the 'network' attack vector and the real-world requirement that a victim open a crafted Word document - the AV:N rating reflects document delivery over a network, not a serverless remote attack. Net: a genuine but routine patch-cycle item, not an emergency; prioritize with standard Office update deployment rather than out-of-band response. |
| Exploit ScenarioDerived | An attacker crafts a malicious Word document that triggers an out-of-bounds read in Office Word's file parser and delivers it via email, chat, or a web download. When the victim opens the document, the flaw leaks adjacent in-memory data (potentially including sensitive content or memory layout), which the attacker exfiltrates or uses to aid further attacks. No public exploit is identified at time of analysis, and successful exploitation depends on the user opening the attacker-supplied file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Out-of-bounds read in Microsoft Word lets a remote, unauthenticated attacker disclose memory contents from an affected host when a victim opens or previews a specially crafted Word document, producing confidentiality-only impact (C:H/I:N/A:N) under a 6.5 CVSS score. Affected builds include Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC for Mac 2021/2024; the required user interaction (UI:R) is the main limiting factor, since nothing triggers the parser automatically. No public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and CISA SSVC records Exploitation as none and Automatable as no, so the risk signals are consistently moderate and non-urgent.
RemediationAI
Vendor-released patches are the primary fix: upgrade Microsoft Office LTSC 2021 to 16.0.14334.20974 or later, Microsoft Office LTSC 2024 to 16.0.17932.21056 or later, and apply the corresponding fixed macOS builds for Office 365 for Mac and Office LTSC for Mac 2021/2024 as listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70263; Microsoft 365 Apps for Enterprise installations should be validated against the current channel release matrix at https://aka.ms/OfficeSecurityReleases, since version numbers there are publication-based rather than fixed build strings. Because exploitation requires the victim to open a crafted document, interim compensating controls are limited to reducing the attack surface: enforce Protected View for files originating from the internet or email attachments so untrusted documents render in a restricted sandbox (trade-off: some document features are disabled and users may experience friction), and use Microsoft Defender Application Guard for Office to open untrusted files in an isolated container that contains parser-level memory reads (trade-off: containerised documents are read-only and the feature requires Windows Enterprise licensing plus Defender for Endpoint). Organisations can also block high-risk inbound attachment types at the mail gateway or use ASR and download-origin policies to prevent internet-sourced Office files from opening directly (trade-off: legitimate business documents may be blocked, so an exception workflow is needed), but macro restriction or disabling the preview pane is not a reliable substitute for patching this parser-level defect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-125, an out-of-bounds read inside the Microsoft Word document parsing engine: a malformed document drives the parser to read beyond the bounds of an allocated buffer and can return adjacent memory contents to the attacker. The supplied tags include Buffer Overflow, but the disclosed weakness class and the CVSS vector (C:H with no integrity or availability impact) describe an information-disclosure read rather than a memory-corruption write, so this should be treated as a disclosure bug, not a code-execution bug. The vector AV:N/PR:N/UI:R indicates the malicious document is delivered over the network by an unauthenticated attacker, while the victim-side requirement is simply that the document be opened or previewed in a default Office configuration, with no special feature, privilege, or non-default setting needed on the target. CPE and version data place the vulnerable parser code in the Word component shared across Office LTSC 2021 and 2024, Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC for Mac 2021/2024, which is why the vendor fix spans both Windows and macOS release trains.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Document delivered over network (AV:N) with no attacker privileges (PR:N) but victim must open the file (UI:R); out-of-bounds read leaks data so C:H, I:N, A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB