EUVD-2026-44217
GHSA-w2q4-mjj7-pcp4
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Local file-open trigger (AV:L, UI:R), no privilege required to open a document (PR:N), impact limited to partial memory read (C:L) with no integrity or availability consequence.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Microsoft Office exposes a limited portion of process memory to a local attacker when a user opens a specially crafted document. Affected products span Office 2016 through LTSC 2024 on both Windows and macOS, with impact confined to low-severity information disclosure and no integrity or availability consequence. No public exploit code exists and CISA has not listed this in KEV; SSVC confirms exploitation status as none and the vulnerability is assessed as non-automatable, collectively placing this in the lowest real-world risk tier despite broad product coverage.
Technical ContextAI
CWE-125 (Out-of-bounds Read) describes a memory safety defect in which a parsing routine reads beyond the bounds of an allocated buffer, potentially exposing adjacent memory contents. In this case the flaw resides within Microsoft Office's document processing subsystem - consistent with the local attack vector and user-interaction requirement, which strongly imply a file-format parser triggered when a crafted document is opened. CPE strings confirm the affected surface spans cpe:2.3:a:microsoft:microsoft_office_2016, microsoft_office_2019, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, microsoft_365_apps_for_enterprise, and their Mac counterparts (microsoft_office_365_for_mac, microsoft_office_ltsc_for_mac_2021, microsoft_office_ltsc_for_mac_2024). The 'Buffer Overflow' tag is a mislabeling common in CVE tagging pipelines - the root cause is a read overflow, not a write overflow, so code execution is not implied by the CWE.
RemediationAI
Vendor-released patch is available. For Windows builds of Office 2016, upgrade to version 16.0.5561.1000 or later. For Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on Windows, apply the latest cumulative update via Microsoft Update or the Office Deployment Tool, referencing the current release table at https://aka.ms/OfficeSecurityReleases. For all Mac variants (Office 365 for Mac, LTSC for Mac 2021, LTSC for Mac 2024), upgrade to version 16.111.26071215 or later through Microsoft AutoUpdate or the Mac App Store. The Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55139 is the authoritative source for patch availability per channel. If immediate patching is not feasible, the most effective compensating control is to configure Protected View or Application Guard in Office to open untrusted documents in an isolated environment, which prevents the vulnerable parser from executing in the user's primary context. Mark-of-the-Web enforcement (ensuring downloaded files retain their MOTW flag) also causes Office to open suspect files in Protected View by default, partially mitigating the attack path without requiring configuration changes.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today