EUVD-2026-99732
GHSA-xr3f-rvf2-9whp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Word document
-
DeliveryDeliver via email or download link
-
ExploitVictim opens document in Office
-
ExecutionOut-of-bounds read leaks process memory
-
ImpactAttacker obtains disclosed information
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted Microsoft Word document (UI:R), so delivery depends on social engineering via email attachment, download, or a shared file rather than a purely remote drive-by. No authentication or elevated privileges are needed on the attacker side (PR:N), and the attack works over a network in the sense that the malicious file is delivered remotely, but it cannot fire without that user action. Limiting factors: user interaction is mandatory, impact is read-only information disclosure (no code execution, integrity, or availability effect per I:N/A:N), and patched builds (Office LTSC 2024 ≥16.0.17932.21056, Office LTSC 2021 ≥16.0.14334.20974, plus updated Microsoft 365 Apps and Mac editions) are not affected. |
| Impact | This is a moderate-priority information-disclosure flaw, not a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) shows network reach and no privileges required, but it is gated by user interaction (UI:R) - a victim must open a malicious Word document - and its impact is confined to confidentiality (C:H), with no integrity or availability effect. All exploitation-urgency signals point low: CISA SSVC records Exploitation=none, Automatable=no, and Technical Impact=partial, which is internally consistent with the CVSS profile (user-interaction requirement makes it non-automatable, and an OOB read yields only partial/confidentiality impact). No EPSS score was supplied in the input, and there is no CISA KEV listing and no public POC, so there is no evidence of active or imminent exploitation. The 'C:H' rating is worth scrutinizing: an out-of-bounds read (CWE-125) typically leaks adjacent memory contents, which NVD scores as high confidentiality impact, though real-world data recovered is often limited and non-deterministic. Bottom line: a genuine but not top-tier issue - patch on a normal cycle, prioritizing users who routinely open externally-sourced Office documents. |
| Exploit ScenarioDerived | An attacker crafts a malicious Word document that triggers an out-of-bounds read in Office's parsing code and emails it to a target or hosts it for download. When the victim opens the document, the flaw leaks adjacent process memory, which the attacker can exfiltrate or use to defeat memory-layout defenses ahead of a further attack. No public exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Out-of-bounds read in Microsoft Word lets an unauthenticated remote attacker disclose information from process memory when a victim opens a specially crafted Word document. Exploitation is gated by user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), so delivery depends on social engineering - a malicious email attachment, download, or shared file - rather than a drive-by or wormable trigger, and the resulting impact is limited to confidentiality (C:H) with no integrity or availability effect. At time of analysis there is no public exploit identified, CISA SSVC records exploitation as none and automatable as no, and Microsoft has released fixed builds (Office LTSC 2024 16.0.17932.21056 and later, Office LTSC 2021 16.0.14334.20974 and later, plus updated Microsoft 365 Apps and Mac editions), making this a moderate-priority information-disclosure issue rather than a critical emergency.
RemediationAI
Vendor-released patch: Microsoft Office LTSC 2024 16.0.17932.21056 and Microsoft Office LTSC 2021 16.0.14334.20974, with Microsoft 365 Apps for Enterprise and the macOS editions remediated through their standard update channels, all detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88169 and the release tracking page at https://aka.ms/OfficeSecurityReleases. Prioritize the LTSC 2024 and LTSC 2021 builds first, since those are the ones with explicit fixed version numbers, and confirm the applied build in Word's Account/About dialog rather than assuming the update landed. Where immediate patching is not possible, the practical compensating control is to prevent untrusted documents from reaching the parser's vulnerable path with minimal trust in the user: leave Microsoft Defender's Attack Surface Reduction rule "Block Office applications from creating child processes" and the Office Trust Center's Protected View enabled for files originating from the internet and email attachments, and use the Office Trust Center File Block Settings to block or open-in-Protected-View for legacy formats (for example Word 97-2003 .doc and RTF) that are common delivery vehicles for parser bugs - the trade-off is that legitimate users of those formats will see an extra prompt or be unable to open the file until it is re-saved in a modern format. Additionally, detonate or sandbox inbound attachments at the email gateway and block direct downloads of unknown .doc/.docx/.rtf files from untrusted sites, accepting the cost of some false positives on benign document traffic. These measures reduce exposure to the social-engineering prerequisite (UI:R) but do not eliminate the flaw, so patching remains the only complete fix; because exploitation must be triggered by a user opening a file, treating unexpected Word crashes or anomalous document renders on unpatched hosts as potential indicators of attempted exploitation is reasonable, though no public exploit code has been identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-125 (Out-of-bounds Read), a memory-safety defect in how Microsoft Word parses document content, where a length or index field in attacker-controlled file data is trusted and used to read past the bounds of an allocated buffer. Word document handling spans the legacy OLE/Compound File Binary container and OOXML/Open Packaging Convention package formats, both of which carry attacker-influenced size, offset, and record-length fields; a malformed value in one of those structures causes the parser to read memory beyond the intended object and then surface those bytes back to the attacker through the rendered document or error behavior, producing the confidentiality-only impact captured by the assessed vector (C:H/I:N/A:N). Because the flaw is a read and not a write primitive, it does not directly provide code execution, which is consistent with the CISA SSVC technical-impact rating of partial and the absence of any integrity or availability metric. The CPE/affected-version data shows the issue is not confined to a single SKU: it spans the perpetual-volume Office LTSC line on Windows (Office LTSC 2024 and Office LTSC 2021), the subscription Microsoft 365 Apps for Enterprise channel, and the macOS builds (Office 365 for Mac, Office LTSC for Mac 2024, Office LTSC for Mac 2021), meaning the shared Word parsing engine is the affected component rather than one product edition. The attack operates over the network only in the sense that the malicious document is delivered remotely; the parser itself runs locally in the context of the victim's Word process, and there is no server-side or pre-authentication exposure path.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Malicious document is delivered remotely (AV:N) with no privileges (PR:N) but requires the victim to open it (UI:R); an OOB read leaks memory so C:H, with no integrity or availability impact (I:N/A:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB