Description

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-11T17:18:37.577Z",
  "pubdate": "2026-08-11T17:18:37.577Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists within Microsoft Office, specifically impacting data handling mechanisms during the parsing of specially crafted documents.\nThe vulnerability allows an unauthorized local attacker to trigger a memory disclosure condition, potentially exposing sensitive system or application memory to the adversary.\nThe affected product is Microsoft Office, with the primary risk involving unauthorized information disclosure that could aid in downstream exploitation efforts such as bypassing defense mechanisms like ASLR.\nExploitation requires an attacker to have local access to the target system and relies on user interaction, typically involving the victim opening a maliciously crafted file within the vulnerable application suite.\nNo privileges are required to initiate the attack sequence beyond the capability to deliver and execute the malicious file locally.",
  "technicalDetails": "The vulnerability stems from an out-of-bounds read flaw located within the file parsing routines of Microsoft Office. The root cause lies in the application's failure to adequately validate boundary conditions and input lengths when processing specific structural elements within a document format.\nWhen a user opens a malformed file, the vulnerable component attempts to read memory offset data based on untrusted size indicators supplied directly within the file structure. Because the application fails to perform proper bounds checking prior to memory access operations, it reads past the allocated buffer boundary into adjacent memory regions.\nThe attack flow proceeds as follows: First, the unauthorized attacker crafts a malicious file containing manipulated structural metadata designed to trigger the out-of-bounds condition. Second, the file is delivered to the target system via local means or secondary vectors. Third, the local user opens the file using Microsoft Office. Fourth, the parsing engine processes the malformed metadata, resulting in an out-of-bounds memory read operation. Finally, the affected component processes or returns the out-of-bounds data, potentially leaking contents of adjacent heap or stack memory back to the application context or crash logs.\nThis vulnerability is classified as a local information disclosure vector. Network exposure is not required for successful exploitation, as the flaw resides entirely in local file processing logic. Authentication is not applicable for local execution, and the attacker operates under standard user privilege constraints.\nThe post-exploitation impact is strictly limited to information disclosure; however, the leaked memory contents may expose sensitive internal pointers, cryptographic keys, or user data that can be leveraged to facilitate more complex multi-stage attacks."
}