Office 2019
Monthly
Information disclosure in Microsoft Office (spanning 365 Apps for Enterprise, LTSC 2021/2024, Office 2019, and macOS variants) is triggered locally when a user opens a specially crafted document, exploiting improper input validation (CWE-20) to expose sensitive information with high confidentiality impact. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) confirms local-only exploitation requiring user interaction, substantially limiting opportunistic mass exploitation. No public exploit has been identified at time of analysis, and Microsoft has released a patch across all affected product lines.
Local information disclosure in Microsoft PowerPoint stems from improper input validation (CWE-20) when processing specially crafted presentation files, affecting a broad range of Office product lines on both Windows and macOS. The CVSS vector (AV:L/UI:R/C:H) confirms that while no special system privileges are required, a victim must open a malicious file, making social engineering the primary delivery mechanism. No public exploit has been identified and no active exploitation is confirmed, but the high confidentiality impact (C:H) warrants prompt patching given the ubiquitous deployment of Microsoft Office.
Information disclosure in Microsoft Office PowerPoint stems from improper input validation (CWE-20) that allows a locally-present attacker to read sensitive data from the vulnerable system when a user opens a crafted file. Affected products span PowerPoint across Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit code or active exploitation has been identified at the time of analysis; a vendor patch is available via standard Office update channels.
Microsoft Office Word's document parsing logic fails to properly validate input (CWE-20), enabling a local attacker to read sensitive information from a target system when a victim opens a specially crafted Word document. The flaw affects a broad range of Microsoft Office releases on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office 2019, and all LTSC variants through 2024. SSVC assessment confirms no current exploitation activity and the attack is not automatable due to required user interaction, though the CVSS confidentiality impact is rated High.
Improper input validation in Microsoft Office Excel enables a local attacker to disclose sensitive information when a target user opens a specially crafted file. The vulnerability affects a broad swath of Microsoft Office product lines - including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, Office 365 for Mac, and Word 2016 - across both Windows and macOS platforms. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; vendor-released patches are available across all affected product lines.
Uninitialized memory disclosure in Microsoft Office exposes sensitive process memory to local attackers who can deliver a crafted document. Affecting a broad range of Office versions across Windows and macOS - including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, and Office 365 for Mac - the flaw yields high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has issued patches via the August 2026 update cycle.
Improper input validation in Microsoft Office PowerPoint enables local information disclosure when a victim opens a specially crafted presentation file. The vulnerability spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, and their macOS counterparts across both subscription and perpetual-license release tracks. Microsoft has released patches via the standard Office update channel; no public exploit has been identified at time of analysis.
Out-of-bounds read in Microsoft Office (Windows and macOS editions, including LTSC 2024, LTSC 2021, 2019, and 365 Apps) enables local information disclosure when a user opens a maliciously crafted document. The CVSS vector (AV:L/UI:R) confirms exploitation is constrained to local, user-triggered scenarios with no code execution or data modification capability. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing exists at time of analysis.
Local information disclosure in Microsoft Office stems from improper input validation (CWE-20), allowing a local attacker who can induce user interaction to read sensitive data from the affected system. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and Office 365/LTSC for Mac, with Mac builds patched at 16.112.26081010 and Windows builds addressed via the Microsoft Office Security Releases channel. No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable attack path.
Local information disclosure in Microsoft Office PowerPoint exposes sensitive data when a user opens a crafted file. The flaw, rooted in improper input validation (CWE-20), affects a broad range of Office versions across Windows and macOS including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 2019. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Microsoft has released patches via its August 2026 update cycle.
Out-of-bounds read in Microsoft Office Word exposes sensitive memory contents to local attackers via crafted document files. Affected products span Word 2016 through Microsoft 365 Apps for Enterprise on both Windows and Mac platforms, covering a broad enterprise install base. Exploitation requires user interaction - a victim must open a malicious document - but yields high confidentiality impact with no integrity or availability loss. No public exploit has been identified at time of analysis.
Out-of-bounds read in Microsoft Office Excel exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a victim to open a crafted spreadsheet file. The flaw affects a wide range of Office versions across both Windows and macOS platforms, including Office 2019, 2021, 2024 LTSC, and Microsoft 365 Apps for Enterprise. No public exploit or active exploitation has been identified at time of analysis; SSVC assessment rates exploitation as none and the attack as non-automatable, indicating moderate real-world urgency despite the High confidentiality impact rating.
Incomplete resource cleanup in Microsoft Office PowerPoint exposes sensitive document data to local attackers across multiple supported product lines, including Microsoft 365 Apps for Enterprise, Office LTSC 2024, LTSC 2021, Office 2019, and PowerPoint 2016. Exploitation requires a victim to open or interact with a PowerPoint file (UI:R), after which residual data - likely temporary files, memory buffers, or cached presentation content - persists in a locally accessible state without requiring attacker privileges. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, keeping real-world risk moderate despite the high confidentiality impact rating.
Out-of-bounds read in Microsoft Excel exposes process memory to local information disclosure across a wide range of Office versions, from Excel 2016 through Microsoft 365 Apps for Enterprise and multiple LTSC releases on both Windows and macOS. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms exploitation requires the victim to open a specially crafted spreadsheet file, making phishing-delivered documents the realistic delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read (CWE-125) in Microsoft Excel triggers information disclosure when a victim opens a specially crafted spreadsheet file, exposing potentially sensitive memory contents to a local attacker. The flaw spans multiple Office product lines - Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and corresponding Mac variants - with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified and SSVC confirms no known exploitation; a vendor patch is available via the Microsoft Security Response Center.
Information disclosure in Microsoft Excel arises from use of uninitialized memory (CWE-908), exposing potentially sensitive heap or stack contents to an attacker when a victim opens a maliciously crafted Excel file. Affected products span the full Microsoft Office portfolio on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, Excel 2016, and their Mac counterparts. No public exploit identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Out-of-bounds read in Microsoft Excel enables local information disclosure when a user opens a specially crafted spreadsheet. Multiple product lines are affected across Windows and macOS, spanning Excel 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise. Microsoft has released patches; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Heap-based buffer overflow in Microsoft Office Word enables a local, unauthenticated attacker to disclose sensitive memory contents by enticing a user to open a maliciously crafted document. Affected products span Microsoft Word 2016, Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows, and Office LTSC/365 on macOS. No public exploit code has been identified at time of analysis, SSVC rates exploitation as none, and Microsoft has released patches via the standard Office update channel.
Out-of-bounds read in Microsoft Office exposes memory contents to local information disclosure across a wide range of affected products including Word 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office 365/LTSC for Mac. The CVSS vector (AV:L/UI:R/C:H) indicates exploitation requires a victim to open a specially crafted Office document, after which sensitive in-process memory can be disclosed to the attacker. No public exploit has been identified at time of analysis, no KEV listing exists, and Microsoft has released patches across all affected product lines.
Information disclosure in Microsoft Word via an off-by-one out-of-bounds read (CWE-125) exposes high-confidentiality data to a local attacker when a user opens a crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the high confidentiality impact and wide deployment footprint make patching a clear priority.
Out-of-bounds read in Microsoft Word's document parsing engine exposes sensitive in-process memory to a local attacker across Office 2016 through LTSC 2024 and macOS variants. Exploitation requires a victim to open a specially crafted document, making social engineering or phishing the primary delivery mechanism. No public exploit code exists and no active exploitation has been identified (not in CISA KEV); SSVC assessment rates exploitation status as none and technical impact as only partial.
Out-of-bounds memory read in Microsoft Office exposes potentially sensitive process memory contents when a victim opens a specially crafted document locally. The vulnerability affects the full Office suite across Windows and macOS - spanning Office 2016 through LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise - with High confidentiality impact per CVSS but no integrity or availability consequence. No public exploit has been identified at time of analysis; CISA SSVC classifies exploitation status as none and the attack is not automatable, significantly reducing real-world prioritization urgency despite the High C rating.
Out-of-bounds read in Microsoft Office Word exposes potentially sensitive memory contents to local attackers when a victim opens a specially crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021 and 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise across both Windows and macOS platforms, with vendor-confirmed patches available. No public exploit code exists and CISA SSVC rates exploitation likelihood as none with only partial technical impact, making this a medium-priority patching item despite the High confidentiality score assigned by CVSS.
Out-of-bounds read in Microsoft Office Word's document parser enables local information disclosure across Windows and Mac product lines, including Office 2016, 2019, 2021, 2024 LTSC, and Microsoft 365 Apps. An attacker who supplies a crafted Word document can cause the application to read beyond allocated memory boundaries, leaking high-confidence memory contents to the attacker. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, though the broad affected product surface and low attack complexity make it a credible phishing delivery vehicle.
Out-of-bounds read (CWE-125) in Microsoft Office enables a local, unauthenticated attacker to disclose sensitive memory contents by convincing a user to open a specially crafted Office document. Affected products span the full modern Office portfolio - Office 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as 'none' with non-automatable delivery, placing this in a lower operational urgency tier despite the High confidentiality impact rating.
Out-of-bounds read (CWE-125) in Microsoft Office Word exposes memory contents to a local, unauthenticated attacker who can trick a user into opening a crafted document, resulting in high-confidence information disclosure with no integrity or availability impact. The vulnerability spans eight distinct Office product lines across Windows and Mac, including Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise, broadening the exposure surface considerably. No public exploit code or active exploitation has been identified per SSVC (Exploitation: none); Microsoft has released patches via the standard Office update channel.
Out-of-bounds read (CWE-125) in Microsoft Office exposes sensitive memory contents to local attackers who can persuade a user to open a specially crafted document. Affected products span multiple Office generations including Office 2016, 2019, 2021, 2024, LTSC variants, and Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none with non-automatable delivery, aligning with the local, user-interaction-dependent CVSS vector.
Out-of-bounds read in Microsoft Office Word exposes high-confidentiality memory contents when a user opens a specially crafted document locally. Affected products span Word 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps for Enterprise, confirmed via EUVD-2026-56423. No public exploit identified at time of analysis and no CISA KEV listing; vendor patch is available, placing this in the routine-patch-cycle priority tier rather than emergency response.
Out-of-bounds read in Microsoft Office exposes sensitive in-process memory contents to local attackers who socially engineer a victim into opening a crafted document. The flaw spans the full Microsoft Office portfolio across Windows and macOS - from Office 2016 through Microsoft 365 Apps for Enterprise - making it broadly relevant for enterprise patch management. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.
Insufficiently protected credentials in Microsoft Office Outlook expose authentication material over network connections, enabling unauthenticated network-positioned attackers to perform spoofing attacks contingent on victim user interaction. The flaw affects Outlook 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - collectively spanning nearly the entire current Outlook product line. Microsoft has released a patch; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to local attackers who can socially engineer a victim into opening a malicious document. Affected products span Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise across both Windows and macOS. No public exploit code is identified and SSVC rates exploitation as none, but the high confidentiality impact warrants timely patching for organizations whose users regularly handle documents from untrusted sources.
Out-of-bounds read in Microsoft Office and SharePoint Server exposes low-level memory contents to a local attacker when a victim opens a crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office 2016/2019/LTSC 2021/2024, Office for Mac variants, and SharePoint Server 2016/2019/Subscription Edition - all at version 16.0.x baselines. The CVSS score of 3.3 (Low) reflects constrained impact: confidentiality is only partially affected, integrity and availability are untouched, and exploitation requires both local access and user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read (buffer over-read) in Microsoft Office exposes sensitive memory contents to a local attacker who can induce a user to open a specially crafted file. Affecting a broad surface including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and mobile/Mac variants, the vulnerability carries a CVSS 4.7 (Medium) with high confidentiality impact but no integrity or availability consequence. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the wide deployment footprint of Microsoft Office makes even targeted information disclosure attacks operationally significant.
Out-of-bounds read in Microsoft Excel exposes limited memory contents to a local attacker when a user opens a specially crafted workbook. Affected product lines span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac variants. With a CVSS score of 3.3 (Low), no public exploit identified at time of analysis, and no CISA KEV listing, this is a low-urgency information disclosure issue - though a notable conflict exists between the description's claim of network-based disclosure and the CVSS AV:L (local) vector that warrants verification against the vendor advisory.
Out-of-bounds read in Microsoft Office triggers local information disclosure when a victim opens a crafted document, exposing adjacent memory contents with high confidentiality impact. The vulnerability spans a wide product surface including Office 2016 through LTSC 2024, Microsoft 365 Apps for Enterprise, multiple SharePoint Server versions, and Mac variants, as confirmed by EUVD-2026-35664. No public exploit or CISA KEV listing is identified at time of analysis; vendor-released patches are available across affected product lines.
Information disclosure in Microsoft Office (spanning 365 Apps for Enterprise, LTSC 2021/2024, Office 2019, and macOS variants) is triggered locally when a user opens a specially crafted document, exploiting improper input validation (CWE-20) to expose sensitive information with high confidentiality impact. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) confirms local-only exploitation requiring user interaction, substantially limiting opportunistic mass exploitation. No public exploit has been identified at time of analysis, and Microsoft has released a patch across all affected product lines.
Local information disclosure in Microsoft PowerPoint stems from improper input validation (CWE-20) when processing specially crafted presentation files, affecting a broad range of Office product lines on both Windows and macOS. The CVSS vector (AV:L/UI:R/C:H) confirms that while no special system privileges are required, a victim must open a malicious file, making social engineering the primary delivery mechanism. No public exploit has been identified and no active exploitation is confirmed, but the high confidentiality impact (C:H) warrants prompt patching given the ubiquitous deployment of Microsoft Office.
Information disclosure in Microsoft Office PowerPoint stems from improper input validation (CWE-20) that allows a locally-present attacker to read sensitive data from the vulnerable system when a user opens a crafted file. Affected products span PowerPoint across Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit code or active exploitation has been identified at the time of analysis; a vendor patch is available via standard Office update channels.
Microsoft Office Word's document parsing logic fails to properly validate input (CWE-20), enabling a local attacker to read sensitive information from a target system when a victim opens a specially crafted Word document. The flaw affects a broad range of Microsoft Office releases on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office 2019, and all LTSC variants through 2024. SSVC assessment confirms no current exploitation activity and the attack is not automatable due to required user interaction, though the CVSS confidentiality impact is rated High.
Improper input validation in Microsoft Office Excel enables a local attacker to disclose sensitive information when a target user opens a specially crafted file. The vulnerability affects a broad swath of Microsoft Office product lines - including Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, Office 365 for Mac, and Word 2016 - across both Windows and macOS platforms. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; vendor-released patches are available across all affected product lines.
Uninitialized memory disclosure in Microsoft Office exposes sensitive process memory to local attackers who can deliver a crafted document. Affecting a broad range of Office versions across Windows and macOS - including Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024, and Office 365 for Mac - the flaw yields high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has issued patches via the August 2026 update cycle.
Improper input validation in Microsoft Office PowerPoint enables local information disclosure when a victim opens a specially crafted presentation file. The vulnerability spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, and their macOS counterparts across both subscription and perpetual-license release tracks. Microsoft has released patches via the standard Office update channel; no public exploit has been identified at time of analysis.
Out-of-bounds read in Microsoft Office (Windows and macOS editions, including LTSC 2024, LTSC 2021, 2019, and 365 Apps) enables local information disclosure when a user opens a maliciously crafted document. The CVSS vector (AV:L/UI:R) confirms exploitation is constrained to local, user-triggered scenarios with no code execution or data modification capability. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing exists at time of analysis.
Local information disclosure in Microsoft Office stems from improper input validation (CWE-20), allowing a local attacker who can induce user interaction to read sensitive data from the affected system. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and Office 365/LTSC for Mac, with Mac builds patched at 16.112.26081010 and Windows builds addressed via the Microsoft Office Security Releases channel. No public exploit has been identified at time of analysis, and SSVC rates exploitation as none with non-automatable attack path.
Local information disclosure in Microsoft Office PowerPoint exposes sensitive data when a user opens a crafted file. The flaw, rooted in improper input validation (CWE-20), affects a broad range of Office versions across Windows and macOS including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 2019. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; Microsoft has released patches via its August 2026 update cycle.
Out-of-bounds read in Microsoft Office Word exposes sensitive memory contents to local attackers via crafted document files. Affected products span Word 2016 through Microsoft 365 Apps for Enterprise on both Windows and Mac platforms, covering a broad enterprise install base. Exploitation requires user interaction - a victim must open a malicious document - but yields high confidentiality impact with no integrity or availability loss. No public exploit has been identified at time of analysis.
Out-of-bounds read in Microsoft Office Excel exposes high-confidentiality memory contents to a local, unauthenticated attacker who can induce a victim to open a crafted spreadsheet file. The flaw affects a wide range of Office versions across both Windows and macOS platforms, including Office 2019, 2021, 2024 LTSC, and Microsoft 365 Apps for Enterprise. No public exploit or active exploitation has been identified at time of analysis; SSVC assessment rates exploitation as none and the attack as non-automatable, indicating moderate real-world urgency despite the High confidentiality impact rating.
Incomplete resource cleanup in Microsoft Office PowerPoint exposes sensitive document data to local attackers across multiple supported product lines, including Microsoft 365 Apps for Enterprise, Office LTSC 2024, LTSC 2021, Office 2019, and PowerPoint 2016. Exploitation requires a victim to open or interact with a PowerPoint file (UI:R), after which residual data - likely temporary files, memory buffers, or cached presentation content - persists in a locally accessible state without requiring attacker privileges. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, keeping real-world risk moderate despite the high confidentiality impact rating.
Out-of-bounds read in Microsoft Excel exposes process memory to local information disclosure across a wide range of Office versions, from Excel 2016 through Microsoft 365 Apps for Enterprise and multiple LTSC releases on both Windows and macOS. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms exploitation requires the victim to open a specially crafted spreadsheet file, making phishing-delivered documents the realistic delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Out-of-bounds read (CWE-125) in Microsoft Excel triggers information disclosure when a victim opens a specially crafted spreadsheet file, exposing potentially sensitive memory contents to a local attacker. The flaw spans multiple Office product lines - Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and corresponding Mac variants - with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified and SSVC confirms no known exploitation; a vendor patch is available via the Microsoft Security Response Center.
Information disclosure in Microsoft Excel arises from use of uninitialized memory (CWE-908), exposing potentially sensitive heap or stack contents to an attacker when a victim opens a maliciously crafted Excel file. Affected products span the full Microsoft Office portfolio on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, Excel 2016, and their Mac counterparts. No public exploit identified at time of analysis; vendor-released patches are available via the Microsoft Security Response Center.
Out-of-bounds read in Microsoft Excel enables local information disclosure when a user opens a specially crafted spreadsheet. Multiple product lines are affected across Windows and macOS, spanning Excel 2016, Office 2019, LTSC 2021, LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise. Microsoft has released patches; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Heap-based buffer overflow in Microsoft Office Word enables a local, unauthenticated attacker to disclose sensitive memory contents by enticing a user to open a maliciously crafted document. Affected products span Microsoft Word 2016, Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 on Windows, and Office LTSC/365 on macOS. No public exploit code has been identified at time of analysis, SSVC rates exploitation as none, and Microsoft has released patches via the standard Office update channel.
Out-of-bounds read in Microsoft Office exposes memory contents to local information disclosure across a wide range of affected products including Word 2016, Office 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office 365/LTSC for Mac. The CVSS vector (AV:L/UI:R/C:H) indicates exploitation requires a victim to open a specially crafted Office document, after which sensitive in-process memory can be disclosed to the attacker. No public exploit has been identified at time of analysis, no KEV listing exists, and Microsoft has released patches across all affected product lines.
Information disclosure in Microsoft Word via an off-by-one out-of-bounds read (CWE-125) exposes high-confidentiality data to a local attacker when a user opens a crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the high confidentiality impact and wide deployment footprint make patching a clear priority.
Out-of-bounds read in Microsoft Word's document parsing engine exposes sensitive in-process memory to a local attacker across Office 2016 through LTSC 2024 and macOS variants. Exploitation requires a victim to open a specially crafted document, making social engineering or phishing the primary delivery mechanism. No public exploit code exists and no active exploitation has been identified (not in CISA KEV); SSVC assessment rates exploitation status as none and technical impact as only partial.
Out-of-bounds memory read in Microsoft Office exposes potentially sensitive process memory contents when a victim opens a specially crafted document locally. The vulnerability affects the full Office suite across Windows and macOS - spanning Office 2016 through LTSC 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise - with High confidentiality impact per CVSS but no integrity or availability consequence. No public exploit has been identified at time of analysis; CISA SSVC classifies exploitation status as none and the attack is not automatable, significantly reducing real-world prioritization urgency despite the High C rating.
Out-of-bounds read in Microsoft Office Word exposes potentially sensitive memory contents to local attackers when a victim opens a specially crafted document. Affected products span Microsoft Word 2016, Office 2019, Office LTSC 2021 and 2024, Office 365 for Mac, and Microsoft 365 Apps for Enterprise across both Windows and macOS platforms, with vendor-confirmed patches available. No public exploit code exists and CISA SSVC rates exploitation likelihood as none with only partial technical impact, making this a medium-priority patching item despite the High confidentiality score assigned by CVSS.
Out-of-bounds read in Microsoft Office Word's document parser enables local information disclosure across Windows and Mac product lines, including Office 2016, 2019, 2021, 2024 LTSC, and Microsoft 365 Apps. An attacker who supplies a crafted Word document can cause the application to read beyond allocated memory boundaries, leaking high-confidence memory contents to the attacker. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, though the broad affected product surface and low attack complexity make it a credible phishing delivery vehicle.
Out-of-bounds read (CWE-125) in Microsoft Office enables a local, unauthenticated attacker to disclose sensitive memory contents by convincing a user to open a specially crafted Office document. Affected products span the full modern Office portfolio - Office 2016 through Office LTSC 2024 and Microsoft 365 Apps for Enterprise. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as 'none' with non-automatable delivery, placing this in a lower operational urgency tier despite the High confidentiality impact rating.
Out-of-bounds read (CWE-125) in Microsoft Office Word exposes memory contents to a local, unauthenticated attacker who can trick a user into opening a crafted document, resulting in high-confidence information disclosure with no integrity or availability impact. The vulnerability spans eight distinct Office product lines across Windows and Mac, including Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise, broadening the exposure surface considerably. No public exploit code or active exploitation has been identified per SSVC (Exploitation: none); Microsoft has released patches via the standard Office update channel.
Out-of-bounds read (CWE-125) in Microsoft Office exposes sensitive memory contents to local attackers who can persuade a user to open a specially crafted document. Affected products span multiple Office generations including Office 2016, 2019, 2021, 2024, LTSC variants, and Microsoft 365 Apps for Enterprise on both Windows and macOS. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none with non-automatable delivery, aligning with the local, user-interaction-dependent CVSS vector.
Out-of-bounds read in Microsoft Office Word exposes high-confidentiality memory contents when a user opens a specially crafted document locally. Affected products span Word 2016, Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps for Enterprise, confirmed via EUVD-2026-56423. No public exploit identified at time of analysis and no CISA KEV listing; vendor patch is available, placing this in the routine-patch-cycle priority tier rather than emergency response.
Out-of-bounds read in Microsoft Office exposes sensitive in-process memory contents to local attackers who socially engineer a victim into opening a crafted document. The flaw spans the full Microsoft Office portfolio across Windows and macOS - from Office 2016 through Microsoft 365 Apps for Enterprise - making it broadly relevant for enterprise patch management. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.
Insufficiently protected credentials in Microsoft Office Outlook expose authentication material over network connections, enabling unauthenticated network-positioned attackers to perform spoofing attacks contingent on victim user interaction. The flaw affects Outlook 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise - collectively spanning nearly the entire current Outlook product line. Microsoft has released a patch; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to local attackers who can socially engineer a victim into opening a malicious document. Affected products span Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise across both Windows and macOS. No public exploit code is identified and SSVC rates exploitation as none, but the high confidentiality impact warrants timely patching for organizations whose users regularly handle documents from untrusted sources.
Out-of-bounds read in Microsoft Office and SharePoint Server exposes low-level memory contents to a local attacker when a victim opens a crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office 2016/2019/LTSC 2021/2024, Office for Mac variants, and SharePoint Server 2016/2019/Subscription Edition - all at version 16.0.x baselines. The CVSS score of 3.3 (Low) reflects constrained impact: confidentiality is only partially affected, integrity and availability are untouched, and exploitation requires both local access and user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read (buffer over-read) in Microsoft Office exposes sensitive memory contents to a local attacker who can induce a user to open a specially crafted file. Affecting a broad surface including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and mobile/Mac variants, the vulnerability carries a CVSS 4.7 (Medium) with high confidentiality impact but no integrity or availability consequence. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the wide deployment footprint of Microsoft Office makes even targeted information disclosure attacks operationally significant.
Out-of-bounds read in Microsoft Excel exposes limited memory contents to a local attacker when a user opens a specially crafted workbook. Affected product lines span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac variants. With a CVSS score of 3.3 (Low), no public exploit identified at time of analysis, and no CISA KEV listing, this is a low-urgency information disclosure issue - though a notable conflict exists between the description's claim of network-based disclosure and the CVSS AV:L (local) vector that warrants verification against the vendor advisory.
Out-of-bounds read in Microsoft Office triggers local information disclosure when a victim opens a crafted document, exposing adjacent memory contents with high confidentiality impact. The vulnerability spans a wide product surface including Office 2016 through LTSC 2024, Microsoft 365 Apps for Enterprise, multiple SharePoint Server versions, and Mac variants, as confirmed by EUVD-2026-35664. No public exploit or CISA KEV listing is identified at time of analysis; vendor-released patches are available across affected product lines.