EUVD-2026-56578
GHSA-mgjf-xg67-j2cr
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local vector because disclosed data is only retrievable in local context; PR:N since crafting the malicious document requires no system privileges; UI:R as the victim must open the file; C:H for meaningful information disclosure with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
AnalysisAI
Microsoft Office Word's document parsing logic fails to properly validate input (CWE-20), enabling a local attacker to read sensitive information from a target system when a victim opens a specially crafted Word document. The flaw affects a broad range of Microsoft Office releases on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office 2019, and all LTSC variants through 2024. SSVC assessment confirms no current exploitation activity and the attack is not automatable due to required user interaction, though the CVSS confidentiality impact is rated High.
Technical ContextAI
The root cause is CWE-20 (Improper Input Validation) in Microsoft Word's file parsing subsystem. When Word processes a malformed or adversarially crafted document, insufficient boundary or content validation of the input data allows controlled reads of memory or file system contents within the local context of the application process. The vulnerability is classified AV:L, meaning the attacker must operate within the local context to collect disclosed data - this is consistent with an attacker either having physical or logical local access to the machine, or using social engineering to trick a local user into opening the file. The vulnerability spans both Windows (Office LTSC 2021/2024, Office 2019, M365 Apps for Enterprise) and macOS (Office 365 for Mac, LTSC for Mac 2021/2024) as identified in EUVD-2026-56578, indicating the flawed input handling code exists in both platform codebases.
RemediationAI
Apply the vendor-released patch immediately via standard Microsoft update channels. For macOS deployments, update Microsoft Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024 to version 16.112.26081010 or later through Microsoft AutoUpdate. For all Windows-based Office products (LTSC 2021, LTSC 2024, Office 2019, and Microsoft 365 Apps for Enterprise), apply the latest security update available at https://aka.ms/OfficeSecurityReleases. As a compensating control prior to patching, enforce Office Protected View for documents originating from the internet or email attachments - this sandboxes document rendering and limits the attacker's ability to leverage user interaction; note that Protected View may disrupt macro-dependent workflows. Additionally, consider deploying Microsoft Defender Application Guard for Office to further isolate untrusted document sessions. Full advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70319.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today