EUVD-2026-44193
GHSA-jcrh-j3jg-vfmc
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Local file-open trigger mandates UI:R and AV:L; OOB read yields confidentiality-only disclosure with no write primitive, so I:N and A:N.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Office (including 365 Apps for Enterprise, Office 2016/2019, LTSC 2021/2024 on Windows and macOS, and SharePoint Server 2016/2019/Subscription Edition) allows a local attacker to disclose limited memory contents when a victim opens a specially crafted document. The CVSS 3.3 Low score, EPSS of 0.51% (40th percentile), SSVC exploitation status of 'none,' and absence from CISA KEV collectively place this vulnerability at low real-world priority despite its broad product footprint. No public exploit or proof-of-concept code has been identified at time of analysis.
Technical ContextAI
CWE-125 (Out-of-Bounds Read) occurs when a parsing or processing routine accesses memory beyond the bounds of an allocated buffer, potentially exposing adjacent memory contents. In Microsoft Office, this class of flaw typically manifests in document format parsers (e.g., compound document structures, XML-based formats, or binary format handlers). The CPE data confirms the vulnerability affects both Windows-based Office editions (cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_office_2016, microsoft_office_2019, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024) and macOS variants (microsoft_office_365_for_mac, microsoft_office_ltsc_for_mac_2021, microsoft_office_ltsc_for_mac_2024), as well as server-side SharePoint products (microsoft_sharepoint_enterprise_server_2016, microsoft_sharepoint_server_2019). The specific Office component triggering the OOB read is not identified in available data, but the local attack vector and user interaction requirement are consistent with file-parsing vulnerabilities activated upon document open. The root cause class (OOB read) produces only information disclosure - there is no write primitive and therefore no code execution path from this flaw alone.
RemediationAI
Apply the vendor-released security updates documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55035. Specific confirmed fixed versions are: Microsoft Office 2016 - update to 16.0.5561.1000 or later; Microsoft Office LTSC for Mac 2021/2024 and Office 365 for Mac - update to 16.111.26071215 or later; Microsoft SharePoint Enterprise Server 2016 - update to 16.0.5561.1001 or later; Microsoft SharePoint Server 2019 - update to 16.0.10417.20175 or later; Microsoft SharePoint Server Subscription Edition - update to 16.0.19725.20434 or later. For Windows editions of Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise, exact build numbers are not specified in available data - apply the latest cumulative update via the OfficeSecurityReleases channel at https://aka.ms/OfficeSecurityReleases. As a compensating control while patching, enforce Protected View via Group Policy (Computer Configuration > Administrative Templates > Microsoft Office) to open documents from external or untrusted sources in a sandboxed read-only mode, which reduces the risk of triggering vulnerable parsing code; note that users who manually bypass Protected View warnings will still be exposed.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today