Description

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-11T17:18:50.030Z",
  "pubdate": "2026-08-11T17:18:50.030Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists within Microsoft Office Word, specifically residing in the document parsing and rendering engine. This security defect allows an unauthorized, locally positioned attacker to achieve arbitrary memory read operations, ultimately resulting in the unauthorized disclosure of sensitive local information. The affected system is Microsoft Office Word. The risk implication centers on the potential leakage of confidential process memory contents, which could expose critical data structures, user information, or cryptographic materials residing in adjacent memory regions. Attacker capabilities are restricted to information disclosure and do not inherently provide remote code execution or direct system compromise based on the provided parameters. Exploitation requirements necessitate local access to the target system and successful inducement of the user to open a specially crafted malicious document file using the vulnerable Microsoft Office Word application. The vulnerability poses a moderate risk to organizational data confidentiality, primarily serving as a vector for reconnaissance or credential harvesting in multi-user or shared environments.",
  "technicalDetails": "The vulnerability is classified as an out-of-bounds read, originating from improper bounds validation within the parsing logic of Microsoft Office Word when processing malformed or maliciously crafted file structures. The vulnerable component resides within the core file parsing modules responsible for interpreting structural elements, layout objects, or embedded streams inside Word documents. The root cause stems from the application failing to adequately verify the size parameters and boundaries of internal data fields specified within the document format against the actual allocated buffer size. Consequently, when the parsing engine attempts to read data based on these untrusted offset values, it reads past the legitimate boundaries of the allocated heap or stack buffer. The attack flow initiates when an unauthorized attacker crafts a specialized document containing corrupted length descriptors or manipulated structural headers. Upon the victim opening this crafted file locally using Microsoft Office Word, the parsing engine processes the malicious structures and executes the out-of-bounds read operation. Because the application reads past the valid memory boundary, contents from adjacent memory segments—potentially containing sensitive application data, remnants of previous operations, or memory addresses—are loaded into application buffers or error logs. Depending on how the application handles the resulting data leak, the disclosed memory contents may be inadvertently exposed to the user interface, written to local cache or log files, or leveraged in subsequent multi-stage attacks to bypass address space layout randomization or other defensive mitigations. The vulnerability requires local access and does not involve network exposure, as it relies on the local opening of a file. Furthermore, authentication and privilege requirements are minimal for the attacker, who only needs the ability to place and execute the file locally within the context of a standard user. No specific elevated privileges are required to trigger the parsing flaw, although the impact is confined to the memory space accessible by the running instance of Microsoft Office Word."
}