Skip to main content

Microsoft Office EUVDEUVD-2026-56576

| CVE-2026-70317 MEDIUM
Use of Uninitialized Resource (CWE-908)
2026-08-11 secure@microsoft.com GHSA-c7fx-4994-8gjq
Information Disclosure Microsoft 365 Apps Microsoft 365 Office 2016 Office 2019 Office 2021 Office 2024
5.5
CVSS 3.1 · NVD
Share

Severity by source

Vendor (microsoft) PRIMARY
MEDIUM
qualitative
NVD
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
5.5 MEDIUM

AV:L confirmed by description (local file-based trigger); PR:N because no attacker account is needed; UI:R because victim must open the crafted document; C:H for memory disclosure with no integrity or availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
Analysis Generated
Aug 11, 2026 - 22:07 vuln.today
Patch available
Aug 11, 2026 - 18:19 EUVD
CVE Published
Aug 11, 2026 - 17:19 nvd
MEDIUM 5.5

DescriptionNVD

Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.

AnalysisAI

Uninitialized memory disclosure in Microsoft Office exposes sensitive process memory to local attackers who can deliver a crafted document. Affecting a broad range of Office versions across Windows and macOS - including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, and Office 365 for Mac - the flaw yields high confidentiality impact with no integrity or availability loss. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft malicious Office document
Delivery
Deliver via phishing or web download
Exploit
User opens document locally
Execution
Uninitialized memory buffer read triggered
Persist
Residual process memory contents disclosed
Impact
Attacker recovers sensitive data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that a user on the local system open a specially crafted Office document, making user interaction (UI:R per CVSS) a hard prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS rates this at 5.5 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a malicious Office document - such as a .docx or .xlsx file - that triggers a code path reading from an uninitialized memory buffer during parsing or rendering. The document is delivered via phishing email or a malicious download link; when the targeted user opens the file in an affected Office version, the application reads residual heap contents and may expose them through document metadata, error output, or a side-channel observable by the attacker if the file is transmitted back (e.g., via embedded remote content). …
Remediation Apply the vendor-released patches distributed through Microsoft's August 2026 Patch Tuesday cycle. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in 365 Apps

View all
CVE-2024-21413 CRITICAL POC
9.8 Feb 13

Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
CVE-2021-42292 HIGH
7.8 Nov 10

Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
CVE-2023-21715 HIGH
7.3 Feb 14

Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
CVE-2026-21509 HIGH POC
7.8 Jan 26

Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
CVE-2026-21514 HIGH
7.8 Feb 10

Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
CVE-2021-38646 HIGH
7.8 Sep 15

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
CVE-2021-34478 HIGH
7.8 Aug 12

Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
CVE-2021-34501 HIGH
7.8 Jul 14

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
CVE-2025-47957 HIGH POC
8.4 Jun 10

Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary

CVE-2022-41106 HIGH
8.8 Nov 09

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
CVE-2023-33148 HIGH POC
7.8 Jul 11

Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack

CVE-2020-0901 CRITICAL
9.8 May 21

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-56576 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy