Description

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-11T17:18:50.693Z",
  "pubdate": "2026-08-11T17:18:50.693Z",
  "executiveSummary": "An out-of-bounds read vulnerability has been identified within Microsoft Office. This security flaw enables an unauthorized, locally positioned attacker to execute unauthorized memory read operations, resulting in sensitive information disclosure.\nThe vulnerability affects Microsoft Office deployments and presents significant risk regarding confidentiality by potentially exposing memory contents to local threat actors. Successful exploitation allows unauthorized disclosure of information locally, bypassing standard memory isolation boundaries.\nThe attack capabilities are constrained to information disclosure without direct remote code execution or modification capabilities based on the provided parameters, and successful exploitation requires local access to the target system.",
  "technicalDetails": "The root cause of the vulnerability stems from an improper bounds check within the memory management handling of Microsoft Office parsers when processing specific file structures or data inputs.\nWhen a user or process opens a maliciously crafted file or interacts with vulnerable components within Microsoft Office, the application attempts to read data from a memory location outside of the allocated buffer boundaries.\nThe vulnerable component is the internal parsing engine of Microsoft Office responsible for handling specific document structures. Due to the absence of rigorous index validation, the function reads adjacent memory addresses, potentially capturing sensitive data residing on the heap or stack.\nThe attack flow proceeds as follows: First, an unauthorized local attacker places or delivers a crafted file to the target system. Second, the victim or a local process opens the file using Microsoft Office. Third, the application parses the malformed structure, triggering the out-of-bounds read condition. Finally, the extracted memory contents may be leveraged by the attacker to glean sensitive data, such as credentials, memory addresses, or internal application states, which can facilitate further exploitation.\nAuthentication and privilege requirements for the primary exploitation vector involve local system access, where the attacker must be capable of executing code or inducing the application to process the malformed input locally.\nThe network exposure for this specific local information disclosure vector is constrained, relying primarily on local execution or local file handling vectors rather than remote network exploitation."
}