Description

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-11T17:18:49.910Z",
  "pubdate": "2026-08-11T17:18:49.910Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in Microsoft Office Word, specifically within the document parsing and rendering engine. This security flaw permits an unauthorized local attacker to read sensitive memory contents, potentially leading to unauthorized information disclosure. The vulnerability affects Microsoft Office Word across supported deployments where maliciously crafted document files are processed. Successful exploitation compromises the confidentiality of system memory, potentially exposing sensitive data structures, credentials, or other application contents residing within the process space. The exploitation requirement involves an attacker convincing a user to open a specially crafted document locally or interacting with the file through an affected application interface. Risk implications center around local confidentiality breaches, which can facilitate subsequent privilege escalation or lateral movement if sensitive data is successfully harvested from the compromised memory bounds. No specific remote code execution or direct system modification capabilities are granted via this read primitive alone, but the information leakage significantly lowers the barrier for multi-stage attacks requiring internal system knowledge.",
  "technicalDetails": "The vulnerability is fundamentally rooted in a boundary validation failure within the Microsoft Office Word component responsible for parsing structural elements inside document files. Specifically, when processing malformed or intentionally corrupted input streams, the application fails to properly verify the size boundaries of memory buffers before executing read operations. This results in an out-of-bounds read condition where the parsing logic attempts to read data past the allocated buffer boundary. The affected component involves the file parsing subsystem of Microsoft Office Word, which handles proprietary or open standard document formats. Exploitation occurs when an unauthorized attacker crafts a malicious document containing manipulated structural offsets, header lengths, or index values that force the parsing engine to read out-of-bounds memory locations. Upon parsing the malicious file, the application reads adjacent memory regions into its operational buffer, which may subsequently be reflected back to the user interface, logged, or processed in a manner that exposes the retrieved contents to the execution context controlled or observed by the attacker. Attack requirements dictate that the attacker must have local access to deliver the file or that the target opens the untrusted file locally. The vulnerability requires zero authentication and no elevated privileges to trigger the initial read condition, functioning entirely within the standard security context of the user running Microsoft Office Word. Network exposure is localized unless combined with other vectors, as the primary vector relies on local file handling. The post-exploitation impact is strictly bounded by the confidentiality loss associated with the leaked memory contents, which may contain sensitive heap data, stack traces, pointers, or remnants of previously processed documents residing within the application address space."
}