EUVD-2026-56576
GHSA-c7fx-4994-8gjq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
AV:L confirmed by description (local file-based trigger); PR:N because no attacker account is needed; UI:R because victim must open the crafted document; C:H for memory disclosure with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Uninitialized memory disclosure in Microsoft Office exposes sensitive process memory to local attackers who can deliver a crafted document. Affecting a broad range of Office versions across Windows and macOS - including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, and Office 365 for Mac - the flaw yields high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has issued patches via the August 2026 update cycle.
Technical ContextAI
CWE-908 (Use of Uninitialized Resource) describes a condition where a software component reads from a memory region before it has been explicitly initialized, potentially leaking residual heap or stack data from earlier allocations. In Microsoft Office's context, this class of bug typically arises in document parsing or rendering components where buffer allocation precedes content population; if an attacker can craft a document that triggers the read path before initialization completes, arbitrary memory contents - including sensitive strings, tokens, or cryptographic material in the process address space - can be surfaced. The CVSS vector (AV:L) confirms the attack surface is local, consistent with file-based delivery rather than a network-reachable service. Affected CPE strings cover Office versions 16.0.0 through 19.0.0 on both Windows and macOS platforms.
RemediationAI
Apply the vendor-released patches distributed through Microsoft's August 2026 Patch Tuesday cycle. On macOS, update Microsoft Office LTSC for Mac 2024, LTSC for Mac 2021, and Office 365 for Mac to build 16.112.26081010 or later. For Microsoft Office 2016 on Windows, update to build 16.0.5565.1001 or later. For Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024 on Windows, apply the latest update referenced at https://aka.ms/OfficeSecurityReleases. As a compensating control where immediate patching is not feasible, restrict the ability of users to open Office documents from untrusted or external sources using Protected View (already enabled by default for internet-origin files); this limits the file-parsing code paths reachable by an attacker-controlled document. Note that Protected View does not fully prevent document parsing, so it is a risk reduction measure rather than a complete mitigation. Additional hardening: enable Attack Surface Reduction rules that block Office from creating child processes, reducing post-disclosure lateral movement opportunity.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today