EUVD-2026-56692
GHSA-v9pm-wvgr-wxq5
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector reflects file-based delivery model; PR:N because no credentials are needed; UI:R because the user must open the crafted document; full C/I/A impact from arbitrary code execution.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
AnalysisAI
Stack-based buffer overflow in Microsoft Office (CWE-121) enables local code execution across a broad range of affected builds including Office 2016, 2019, LTSC 2021, LTSC 2024, Office 365 for Mac, LTSC for Mac 2021/2024, and Microsoft 365 Apps for Enterprise. Exploitation requires user interaction - consistent with a maliciously crafted document delivery model - and achieves full confidentiality, integrity, and availability compromise within the Office process context. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available via the MSRC advisory.
Technical ContextAI
CWE-121 (Stack-based Buffer Overflow) describes a condition where a program writes beyond the bounds of a stack-allocated buffer, corrupting adjacent stack memory including saved frame pointers and return addresses. In Microsoft Office, this class of flaw typically resides in file-format parsing routines - where attacker-controlled input from a crafted document drives a copy or write operation without adequate bounds enforcement. The affected product family spans both Windows and macOS Office runtimes, as indicated by EUVD-2026-56692 CPE data covering Office 2016 through Office LTSC 2024 and the Mac-specific 365/LTSC variants. Successful exploitation hijacks the instruction pointer at function return, redirecting execution to attacker-controlled shellcode. The CVSS vector AV:L/AC:L reflects that the payload must be delivered as a local file rather than over a network socket, consistent with document-borne attack models.
RemediationAI
Apply the vendor-released patches as the primary remediation. For macOS builds, upgrade to version 16.112.26081010 or later, which fixes Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024. For Microsoft Office 2016 on Windows, upgrade to build 16.0.5565.1001 or later - this is the only Windows fix version with a confirmed build number in the provided data. For Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise on Windows, consult the patched build references at https://aka.ms/OfficeSecurityReleases and the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63526 for current fix builds, as exact version numbers were not independently confirmed from available data. Where immediate patching is not possible, enable Microsoft Office Protected View via Group Policy to open untrusted documents in a sandboxed read-only mode, which prevents code execution but can be bypassed under certain conditions and does not substitute for patching. Additionally, configure Group Policy to block macros from internet-sourced files and restrict users from opening Office documents directly from email clients or browsers without first saving them - reducing the surface for automated delivery of malicious documents.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today