Skip to main content

Microsoft Office EUVDEUVD-2026-73842

| CVE-2026-80091 MEDIUM
Use of Uninitialized Resource (CWE-908)
2026-09-08 secure@microsoft.com GHSA-f7m9-p994-pr6w
Information Disclosure Microsoft 365 Apps Microsoft 365 Office 2021 Office 2024 Office 2019 Office 2016
6.5
CVSS 3.1 · Vendor: microsoft
Share

Severity by source

Vendor (microsoft) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
vuln.today AI
6.5 MEDIUM

Network-delivered malicious document requires user interaction but no attacker authentication; impact is confidentiality-only with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
Analysis Generated
Sep 08, 2026 - 22:34 vuln.today
Patch available
Sep 08, 2026 - 18:35 EUVD
CVE Published
Sep 08, 2026 - 18:20 cve.org
MEDIUM 6.5

DescriptionCVE.org

Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Uninitialized resource use (CWE-908) in Microsoft Office exposes high-confidentiality data to remote unauthenticated attackers when a victim opens a specially crafted Office document. The vulnerability spans the full Microsoft Office ecosystem - Office 2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Mac variants - making the affected surface extremely broad. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation User interaction is required: the victim must open or preview a specially crafted Office document file. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS base score is 6.5 (Medium), driven by C:H with no integrity or availability impact, and the requirement for user interaction (UI:R) that caps exploitability below fully automated attacks. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patches are available for all Windows-platform variants. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in 365 Apps

View all
CVE-2024-21413 CRITICAL POC
9.8 Feb 13

Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
CVE-2021-42292 HIGH
7.8 Nov 10

Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
CVE-2023-21715 HIGH
7.3 Feb 14

Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
CVE-2026-21509 HIGH POC
7.8 Jan 26

Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
CVE-2026-21514 HIGH
7.8 Feb 10

Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
CVE-2021-38646 HIGH
7.8 Sep 15

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
CVE-2021-34478 HIGH
7.8 Aug 12

Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
CVE-2021-34501 HIGH
7.8 Jul 14

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
CVE-2025-47957 HIGH POC
8.4 Jun 10

Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary

CVE-2022-41106 HIGH
8.8 Nov 09

Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
CVE-2023-33148 HIGH POC
7.8 Jul 11

Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack

CVE-2020-0901 CRITICAL
9.8 May 21

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-73842 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy