EUVD-2026-43756
GHSA-ch74-4vwm-9897
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Office document
-
DeliveryDeliver via email or download
-
ExploitVictim opens file in Office
-
ExecutionParser performs out-of-bounds read
-
ImpactLeak sensitive memory or crash app
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-crafted document in an affected Office application (UI:R user interaction is mandatory) - there is no remote unauthenticated network path and no prior authentication is needed (PR:N). Limiting factors: the attacker cannot trigger the bug without the victim actively opening the malicious file, and Microsoft's Protected View sandbox for internet/email-sourced documents further constrains automatic exploitation. Affected deployments are the specific Office builds listed in the CPE data (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac 2021/2024/365). |
| Impact | The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U) describes a local, low-complexity vulnerability that needs no privileges but does require user interaction - the realistic delivery being a victim opening a malicious document, so the 'local' vector is effectively file-borne rather than requiring shell access. Note an internal inconsistency worth verifying: the vulnerability is described purely as information disclosure, yet the vector sets I:N but A:H (high availability impact), which is unusual for a pure OOB read and may reflect that the over-read can also crash the application; treat the A:H as vendor-assigned and confirm against the MSRC advisory. No EPSS score was supplied, and there is no KEV listing or POC in the provided data, so exploitation probability cannot be quantified and should be treated as currently low but not negligible given Office's attack surface. This is a patch-on-schedule item rather than an emergency: high confidentiality impact but gated behind user interaction and no evidence of active exploitation. |
| Exploit ScenarioDerived | An attacker emails a victim a specially crafted Office document that triggers the out-of-bounds read when opened in a vulnerable Office build. Because the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), the attacker relies on social engineering to get the file opened, after which sensitive process memory may be leaked back to the attacker or cause the application to crash. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) via an out-of-bounds read (CWE-125) lets an attacker leak sensitive memory contents when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.1 (AV:L/AC:L/PR:N/UI:R), reflecting local exploitation that requires user interaction but no prior authentication. Microsoft is the reporting source and has published a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-56193 as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56193, which covers Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and the corresponding Office for Mac builds; the exact fixed build numbers are enumerated in that advisory and should be applied via your normal Windows/Microsoft AutoUpdate channel. Where immediate patching is not possible, reduce exposure by opening untrusted documents in Protected View and ensuring it is not disabled for internet- and email-originated files (trade-off: users must click to exit Protected View for legitimate editing), and by blocking or quarantining Office attachments from untrusted senders at the mail gateway (trade-off: may delay legitimate documents). Disabling the specific affected file-format handler is not advisable as a general control since the vulnerable component is not identified in the provided data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-125 out-of-bounds read in one of the file-format parsers bundled with the Microsoft Office suite. Office applications parse complex binary and OOXML document structures; when a length or offset field in a crafted file is not properly validated, the parser reads memory beyond the bounds of the intended buffer. The CPE data confirms the affected code is shared across the desktop Office family: cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_office_2016, microsoft_office_2019, microsoft_office_365_for_mac, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, and the LTSC for Mac 2021/2024 builds - indicating a defect in a common parsing component rather than an app-specific bug. The 'Buffer Overflow' tag alongside 'Information Disclosure' aligns with the out-of-bounds-read root cause, where over-read memory is surfaced back to the attacker.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
File-borne local vector needing victim to open a document (AV:L/UI:R, PR:N); OOB read yields high confidentiality but at most a crash, so A:L and I:N.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Executive ViewAI
Microsoft Office products (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, Office for Mac) are vulnerable to information disclosure attacks triggered by opening maliciously crafted documents, potentially exposing sensitive data from employee device memory. Though no public exploit has been identified at time of analysis, this vulnerability affects organizations across all industries where Office is deployed. Leadership should prioritize immediate remediation because the attack requires only routine user action (opening a document), which is difficult to control through traditional security awareness training.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Exploit-DB