EUVD-2026-44212
GHSA-vm6w-v59c-562f
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Exploitation requires local file open with user interaction (AV:L, UI:R); no OS privileges needed; truncation only leaks data with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
AnalysisAI
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a maliciously crafted document, exposing potentially sensitive memory contents with high confidentiality impact (C:H). The vulnerability spans a broad range of Microsoft Office and SharePoint products - including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Word 2016, Office 2019, Office 365 for Mac, and multiple SharePoint Server versions. No public exploit identified at time of analysis; CISA SSVC rates exploitation as none, EPSS stands at 0.39% (31st percentile), and a vendor-released patch is available from Microsoft.
Technical ContextAI
CWE-197 (Numeric Truncation Error) occurs when a numeric value is implicitly or explicitly narrowed during a type cast or arithmetic operation, causing data loss or an incorrect boundary calculation. In a document parser context, this commonly manifests as an integer truncation that produces a value smaller than the true size of a data structure, leading the parser to read from or expose memory regions beyond intended bounds - resulting in an information leak. The CPE data confirms affected products across two families: the Office productivity suite (cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_office_2019, microsoft_office_365_for_mac, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, microsoft_word_2016) and the SharePoint server platform (microsoft_sharepoint_enterprise_server_2016, microsoft_sharepoint_server_2019, microsoft_sharepoint_server_subscription_edition). The presence of SharePoint in the CPE list suggests the vulnerability may also surface in server-side document rendering or preview components, not exclusively in the desktop Word client.
RemediationAI
Apply the vendor-released patches immediately through your standard Office update channel. For SharePoint Enterprise Server 2016, update to build 16.0.5561.1001 or later; for SharePoint Server 2019, update to build 16.0.10417.20175 or later; for SharePoint Server Subscription Edition, update to build 16.0.19725.20434 or later; for Word 2016, update to build 16.0.5561.1000 or later; for Office 365 for Mac, update to build 16.111.26071215 or later. For Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 2019, apply available updates via https://aka.ms/OfficeSecurityReleases. If patching is temporarily delayed for Click-to-Run products, a compensating control is to configure Protected View to open all documents from external or untrusted sources in read-only mode - this adds a user-confirmation step before the document parser fully processes content, reducing attack surface; note this does not eliminate the vulnerability and may reduce workflow productivity for users who regularly open external documents. Full advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55142.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-197 – Numeric Truncation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today