EUVD-2026-35670
GHSA-8wpv-9rm8-hj6h
Severity by source
AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read (buffer over-read) in Microsoft Office exposes sensitive memory contents to a local attacker who can induce a user to open a specially crafted file. Affecting a broad surface including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and mobile/Mac variants, the vulnerability carries a CVSS 4.7 (Medium) with high confidentiality impact but no integrity or availability consequence. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the wide deployment footprint of Microsoft Office makes even targeted information disclosure attacks operationally significant.
Technical ContextAI
CWE-126 (Buffer Over-Read) describes a condition where software reads memory beyond the allocated bounds of a buffer, potentially exposing adjacent memory contents to the caller or an attacker. Despite the 'Buffer Overflow' tag in the source intelligence, CWE-126 is specifically an over-read - not a write-past-bounds - meaning arbitrary code execution is not the primary risk; rather, sensitive in-process memory (heap/stack data, pointers, credentials cached in memory) may be leaked. The flaw exists within Microsoft Office's document-processing code paths and manifests across multiple platforms: Windows (365 Apps for Enterprise 16.0.1, Office 2019 19.0.0, Office LTSC 2021 16.0.1, Office LTSC 2024 16.0.0), macOS (Office 365 for Mac, LTSC for Mac 2021, LTSC for Mac 2024), and Android (Microsoft Office for Android). The attack vector is local (AV:L), meaning the malicious file must be accessed on the victim's machine, and high attack complexity (AC:H) suggests a specific triggering condition - likely a particular document structure or feature invocation - is required to reliably reproduce the read.
RemediationAI
Apply the vendor-released patch via Microsoft's standard Office update mechanism; the authoritative patch index is published at https://aka.ms/OfficeSecurityReleases and the MSRC advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45460. Exact fixed build numbers were not independently confirmed from the provided intelligence - consult the MSRC advisory directly to verify the minimum fixed version for each affected SKU. For organizations unable to patch immediately, the primary compensating control is to restrict users from opening untrusted Office documents, particularly those received via email or downloaded from the internet - enforcing Protected View and disabling macro execution (already a Microsoft default) limits the document-parsing attack surface without disabling Office functionality. On Windows endpoints, enabling Attack Surface Reduction (ASR) rules that block Office applications from creating child processes adds a defense-in-depth layer, though it does not directly mitigate this read-only memory disclosure. The trade-off of blocking external document opening is reduced collaboration functionality for users who routinely work with externally sourced files.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today