EUVD-2026-56580
GHSA-f56g-8wr8-98q6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local delivery of crafted document required (AV:L); victim must open it (UI:R); no system privileges needed; only confidentiality impacted, no integrity or availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Information disclosure in Microsoft Office (spanning 365 Apps for Enterprise, LTSC 2021/2024, Office 2019, and macOS variants) is triggered locally when a user opens a specially crafted document, exploiting improper input validation (CWE-20) to expose sensitive information with high confidentiality impact. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) confirms local-only exploitation requiring user interaction, substantially limiting opportunistic mass exploitation. No public exploit has been identified at time of analysis, and Microsoft has released a patch across all affected product lines.
Technical ContextAI
The root cause is CWE-20 (Improper Input Validation), a broad class of weaknesses where software fails to properly sanitize, restrict, or validate input before processing it. In this context, Microsoft Office's document processing pipeline does not adequately validate crafted input, allowing malicious document content to trigger an unintended code path that leaks sensitive information - likely from process memory, temporary file contents, or parsed document metadata. The vulnerability spans multiple Office release tracks (365 Apps for Enterprise, LTSC 2021 and 2024, Office 2019, and their macOS counterparts), indicating the vulnerable input-handling code resides in a shared Office component rather than a platform-specific module. The CVSS local attack vector (AV:L) and unscoped impact (S:U) confirm the flaw does not grant cross-process or cross-privilege-boundary access beyond the Office application context.
RemediationAI
Apply the vendor-released patch immediately via Microsoft Update or the Office deployment tooling in use. For macOS deployments (Office 365 for Mac, Office LTSC for Mac 2021/2024), upgrade to build 16.112.26081010 or later - this is the confirmed fixed version per EUVD data. For Windows deployments of Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024, and Office 2019, apply the update listed at https://aka.ms/OfficeSecurityReleases; specific Windows build numbers were not independently confirmed in available intelligence, so consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70323 for authoritative version targets. If immediate patching is not feasible, enforce Office Protected View for documents received from external or untrusted sources - this adds a sandboxed rendering layer that can interrupt exploitation, though it may require users to explicitly enable editing and introduces friction for legitimate workflows. Restrict opening of untrusted Office files via Group Policy (disable automatic macro execution and external content loading) as an additional compensating control.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today