EUVD-2026-56690
GHSA-r8p5-v2rq-634c
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file-triggered OOB read requires user to open document (UI:R); no integrity or availability impact, confidentiality high due to memory disclosure.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read (CWE-125) in Microsoft Office exposes sensitive memory contents to local attackers who can persuade a user to open a specially crafted document. Affected products span multiple Office generations including Office 2016, 2019, 2021, 2024, LTSC variants, and Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none with non-automatable delivery, aligning with the local, user-interaction-dependent CVSS vector.
Technical ContextAI
The vulnerability is classified as CWE-125 (Out-of-bounds Read), a memory safety defect in which a parsing routine within Microsoft Office reads beyond the bounds of an allocated buffer. The associated tag 'Buffer Overflow' suggests the OOB read may occur in close proximity to a related memory boundary condition during document processing. The attack surface is local file handling - a crafted Office document triggers the unsafe memory read when opened, potentially leaking heap or stack memory contents to an attacker who controls the document. The AV:L/UI:R CVSS vector confirms the vulnerability manifests at the application layer during document parsing rather than over a network protocol. Affected CPE-equivalent products include Microsoft Office 2016 (16.0.x), Office 2019 (19.0.x), Office LTSC 2021 and 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise (16.0.x), all published via EUVD-2026-56690.
RemediationAI
Patch available per vendor advisory. For Microsoft Office 2016 on Windows, upgrade to build 16.0.5565.1001 or later (the only explicitly versioned Windows fix in the EUVD data). For Microsoft Office LTSC for Mac 2021, LTSC for Mac 2024, and Office 365 for Mac, upgrade to version 16.112.26081010 or later. For Office 2019, Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, apply updates via Microsoft Update or consult https://aka.ms/OfficeSecurityReleases for the current patched build numbers, as exact fix versions were not enumerated in available data for those products. The full MSRC advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63524. If immediate patching is not possible, the attack requires a user to open a crafted document, so organizations can reduce exposure by enforcing Protected View for documents received from external sources via Group Policy (Office Trust Center settings), which blocks active content and limits document parsing to a sandboxed read-only mode - note this may impair macro-dependent workflows. Disabling automatic preview of Office files in Windows Explorer is an additional low-friction compensating control.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today