EUVD-2026-44248
GHSA-qxgq-qrj7-v4gg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Office document
-
DeliveryDeliver via email or file share
-
ExploitVictim opens file in Office
-
ExecutionParser performs out-of-bounds read
-
PersistLeak adjacent process memory
-
ImpactExfiltrate disclosed data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied malicious Office file on an affected build (UI:R), and delivery is local (AV:L) - typically via email attachment, download, or file share rather than a remote network service. No authentication is needed against the target application (PR:N) and complexity is low (AC:L), but the mandatory user interaction is the key limiting factor: absent a user opening the crafted document, the vulnerability cannot be triggered. There is no special server configuration prerequisite; any default Office installation from the affected list is exposed once a user opens the file. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity, unauthenticated attack gated by user interaction - the classic 'open a malicious document' pattern. There is a notable internal conflict: the CWE (out-of-bounds read) and the description ('disclose information') point to a confidentiality-only impact, yet the supplied vector claims C:H/I:H/A:H (full integrity and availability impact). An out-of-bounds read alone does not normally justify I:H/A:H, so that portion of the vector appears inflated relative to the stated impact - verify with the Microsoft advisory before treating this as an integrity/availability risk. No EPSS score was provided, the vulnerability is not in CISA KEV, and no POC is referenced, so this is a patch-on-normal-cycle item rather than an emergency, though the ubiquity of Office and the low exploitation complexity mean it should not be deferred indefinitely. |
| Exploit ScenarioDerived | An attacker emails a victim a specially crafted Office document (or hosts it on a web share) and lures them into opening it. When Office parses the malformed structure, the out-of-bounds read leaks adjacent process memory, which the attacker can exfiltrate or use to reveal ASLR addresses that strengthen a separate memory-corruption exploit. No public exploit code is identified at time of analysis, and the attack requires the local user to open the file (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Information disclosure in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, Office LTSC 2021/2024, and Office for Mac) arises from an out-of-bounds read (CWE-125) that lets an attacker who convinces a victim to open a crafted file read memory beyond an intended buffer boundary. Exploitation is local and requires user interaction, and there is no public exploit identified at time of analysis and no CISA KEV listing. Disclosed memory can leak sensitive data such as heap contents or pointer addresses useful for defeating ASLR in a follow-on exploit chain.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50665 for each affected channel (Microsoft 365 Apps via Click-to-Run, the monthly security update for Office 2016/2019 and Office LTSC 2021/2024, and the corresponding Office for Mac update). The provided data does not include exact fixed build numbers, so pull them from the MSRC update guide for your specific channel. As compensating controls until patching, open untrusted documents in Protected View / Application Guard to sandbox the parser, block or restrict inbound Office attachments from untrusted sources at the mail gateway, and enforce 'block macros/content from the Internet' policies; the trade-off is reduced usability for legitimate external documents and Protected View does not guarantee the OOB read path is unreachable, so patching remains the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-125 out-of-bounds read within Microsoft Office's file-format parsing code. When Office parses a maliciously crafted document, a length or index field is trusted without adequate bounds checking, causing a read past the end of an allocated buffer. CPE data confirms the affected code is shared across the Office family: microsoft_365_apps_for_enterprise, microsoft_office_2016, microsoft_office_2019, microsoft_office_365_for_mac, and microsoft_office_ltsc_2021/2024 (including the for_mac 2021/2024 variants), indicating the vulnerable parser is present in both Windows and macOS builds. Out-of-bounds reads of this class typically leak adjacent heap/stack memory rather than corrupting it, which is why the primary impact is information disclosure.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Local malicious-file delivery with required user interaction and no auth; an out-of-bounds read yields high confidentiality disclosure only, so I and A are N.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Executive ViewAI
Microsoft Office (365 Apps, Office 2016/2019, LTSC 2021/2024, and Office for Mac) contains a high-severity information disclosure vulnerability (CVSS 7.8) that could leak sensitive memory contents if users open malicious files, potentially enabling attackers to bypass system security protections in follow-on attacks. This poses significant risk to organizations where Office is widely deployed, particularly those with users handling confidential data or in security-sensitive roles. Prompt patching combined with user awareness training is essential to mitigate exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Exploit-DB