Description

Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:50.163Z",
  "pubdate": "2026-08-11T17:18:50.163Z",
  "executiveSummary": "An integer overflow or wraparound vulnerability has been identified within Microsoft Office. This security flaw enables an unauthorized, locally authenticated attacker to achieve arbitrary code execution on the target system.\nThe vulnerability resides in the way Microsoft Office handles arithmetic operations during data parsing or memory allocation. When specific malformed input or file structures are processed, an integer overflow occurs, leading to memory corruption such as a buffer overflow.\nThe risk implication is severe, as successful exploitation permits the execution of arbitrary code within the context of the current user. If the user possesses elevated privileges, the attacker can inherit those privileges, compromising the integrity, confidentiality, and availability of the host operating system.\nAttacker capabilities are constrained by the requirement for local access or user interaction, typically necessitating that the victim open a specially crafted malicious file using a vulnerable version of Microsoft Office. The exploitation vector does not inherently require network exposure, relying instead on local vector execution or user-assisted file opening.",
  "technicalDetails": "The root cause of the vulnerability stems from an integer overflow or wraparound condition in Microsoft Office. This condition typically occurs when untrusted size or length values derived from file headers or network payloads are used in arithmetic calculations—such as addition or multiplication—prior to allocating memory buffers.\nWhen an overly large value is processed, the resulting integer wraps around to a small positive number or a negative value. Consequently, the memory allocation routine allocates a buffer that is significantly smaller than required to hold the incoming data. When the application subsequently copies or writes data into this undersized buffer, a heap-based or stack-based buffer overflow occurs.\nThe vulnerable component involves the internal parsing engines within Microsoft Office responsible for decoding proprietary or open file formats. The affected software includes specific versions of Microsoft Office as indicated by the vulnerability scope. Exploitation requires no prior authentication if the attacker has local file system access, or it relies on tricking a local user into opening a malicious document.\nThe step-by-step attack flow proceeds as follows: First, the attacker crafts a malicious file containing manipulated header fields designed to trigger the integer overflow during parsing. Second, the victim opens the crafted file using a vulnerable installation of Microsoft Office. Third, the parsing engine processes the malicious headers, executing an insecure arithmetic operation that results in an integer wraparound. Fourth, the application allocates a mismatched memory buffer based on the wrapped value. Fifth, subsequent read operations write out-of-bounds data into adjacent memory regions, corrupting critical control data or function pointers. Finally, the attacker redirects execution flow to embedded shellcode or payload instructions, resulting in local code execution with the privileges of the victim process."
}