EUVD-2026-63617
GHSA-r6q7-c86h-xxvp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Word document
-
DeliveryDeliver via email or web link
-
ExploitVictim opens document in Word
-
ExecutionInput validation flaw triggered in parser
-
ImpactSensitive data disclosed to attacker over network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | All affected Microsoft Office Word installations running pre-patch builds on both Windows and macOS are in scope - no special non-default feature enablement or configuration is required. The primary limiting factor is document delivery and processing: the attacker must successfully deliver a crafted Word file to the target, and the victim must process it (open or preview it) using a vulnerable Office build. SSVC's 'Automatable: no' designation suggests end-to-end exploitation is not fully scriptable, likely because victim document interaction is needed even if not reflected in the vendor's CVSS UI:N. No authentication to any service or network resource is required on the attacker side. |
| Impact | The vendor-assigned CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) classifies this as high severity with unauthenticated remote access and high confidentiality impact. However, several signals moderate the real-world priority: EPSS at 0.54% (43rd percentile) indicates low observed exploitation probability; SSVC categorizes exploitation as 'none' and automatable as 'no', which conflicts with the vendor's UI:N/AC:L vector - a parsing vulnerability in a desktop Office application typically requires a user to open a malicious document (implying UI:R rather than UI:N). No active exploitation has been confirmed by CISA KEV, and no public POC has been identified. The combination of no known exploitation, low EPSS, and SSVC's 'Automatable: no' places this at medium operational priority despite the 7.5 score. The discrepancy between CVSS UI:N and SSVC's 'Automatable: no' should be verified with the vendor, as the former significantly affects automated campaign risk. |
| Exploit ScenarioDerived | An attacker crafts a malicious Word document that exploits the input validation flaw to trigger disclosure of memory contents or sensitive file data when processed by the Word parser. The document is delivered to the target via email, shared drive link, or a compromised web resource; when the victim opens it, Word's parser leaks information back to an attacker-controlled endpoint over the network. No public exploit code has been identified, making opportunistic mass exploitation unlikely at present. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 04, 2026
Information disclosure via improper input validation in Microsoft Office Word enables unauthenticated remote attackers to extract sensitive data across a broad product surface spanning Word 2016, Office 2019, multiple LTSC releases, and Microsoft 365 Apps for Enterprise on both Windows and macOS. The vendor-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no user interaction is required, though SSVC's 'Automatable: no' designation creates measurable tension with that assessment. No public exploit has been identified at time of analysis, and EPSS at 0.54% (43rd percentile) reflects low near-term exploitation probability despite the CVSS 7.5 rating.
Earlier versions of this analysis (1)
Information disclosure in Microsoft Office Word allows unauthenticated remote attackers to exfiltrate sensitive data by enticing a user to open a maliciously crafted document. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms network-based exploitation requiring no authentication on the attacker's side but mandating user interaction - the high confidentiality impact signals potentially significant data exposure. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected Office product lines.
RemediationAI
Apply vendor-released patches immediately. For macOS, update to Microsoft Office for Mac version 16.112.26081010 or later - this single build covers Office 365 for Mac, LTSC for Mac 2021, and LTSC for Mac 2024. For Microsoft Word 2016 on Windows, update to build 16.0.5565.1000 or later. For Microsoft Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on Windows, apply the update referenced at https://aka.ms/OfficeSecurityReleases. The authoritative guidance is the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70105. Organizations with Microsoft 365 and automatic updates enabled will receive the fix without manual action. If patching must be deferred, consider restricting external Word document delivery through email gateway policies (blocking .docx/.doc from untrusted senders) or enabling Defender Attack Surface Reduction rules targeting Office file-handling behaviors; note these may disrupt legitimate document workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from CWE-20 (Improper Input Validation) in Microsoft Word's document parsing or input-handling logic, enabling an attacker to trigger information leakage through a network-accessible attack path. The broad CPE coverage spans cpe:2.3:a:microsoft:microsoft_word_2016, cpe:2.3:a:microsoft:microsoft_office_2019, cpe:2.3:a:microsoft:microsoft_office_ltsc_2021, cpe:2.3:a:microsoft:microsoft_office_ltsc_2024, cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, and their macOS counterparts (microsoft_office_365_for_mac, microsoft_office_ltsc_for_mac_2021, microsoft_office_ltsc_for_mac_2024). CWE-20 at the root indicates that a Word file parser or related input-handling routine fails to properly validate attacker-controlled data, causing unintended memory or file content to be disclosed back across the network.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Document-processing flaw in Word most plausibly requires opening a malicious file, warranting UI:R over the vendor's UI:N, consistent with SSVC 'Automatable: no'; all other metrics retained.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Executive ViewAI
Microsoft Office Word (versions 2016, 2019, LTSC editions, and Microsoft 365 Apps for Enterprise across Windows and macOS) is vulnerable to unauthenticated remote information disclosure that enables attackers to extract sensitive document data without triggering user warnings. This affects a broad installed base and poses material risk to data confidentiality across typical enterprise deployments. Urgent patching is required to close the attack surface.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Exploit-DB