Description

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:51.463Z",
  "pubdate": "2026-08-11T17:18:51.463Z",
  "executiveSummary": "A buffer over-read vulnerability has been identified within Microsoft Office Word, posing significant security risks to affected systems. This vulnerability is classified as a memory-handling flaw that occurs when the application reads past the end of an allocated buffer while parsing specially crafted document structures. Successful exploitation of this flaw allows an unauthorized local attacker to execute arbitrary code within the context of the current user, potentially compromising system integrity and data confidentiality.\nThe affected product is Microsoft Office Word. The risk implications are severe, as arbitrary code execution can lead to full system compromise if the targeted user operates with elevated privileges. The attacker's capabilities include local code execution, requiring the target to open a malicious document file supplied by the threat actor. Exploitation relies on social engineering to deliver the malicious payload to the victim machine, where the vulnerable parser processes the malformed input and triggers the out-of-bounds read condition, leading to unintended memory exposure or subsequent memory corruption states utilized for arbitrary execution.",
  "technicalDetails": "The vulnerability stems from inadequate bounds checking within the Microsoft Office Word parsing engine when processing specific internal file formats and document structures. The root cause is a buffer over-read condition, where the software attempts to read data from a memory location beyond the allocated boundaries of a specific buffer. This occurs because length fields or offset indicators embedded within the malicious file are manipulated to mislead the parsing routine regarding the true dimensions of the input data.\nDuring the attack flow, the unauthorized local attacker crafts a malicious document designed to exploit the parsing anomaly. When the victim opens the file using a vulnerable version of Microsoft Office Word, the application initiates the parsing of the malformed internal structures. The vulnerable component fails to properly validate the input lengths against the allocated buffer size, resulting in the reading of adjacent memory regions. Depending on the precise memory layout and the specific implementation of the heap or stack, this over-read condition exposes sensitive memory contents or facilitates further exploitation primitives.\nAuthentication requirements are absent, as the file processing is initiated locally upon opening the document. Privilege requirements dictate that the attacker must have local access to deliver the file, and code execution occurs under the privilege level of the locally logged-in user running Microsoft Office Word. Network exposure is not strictly required for direct exploitation if the file is delivered via removable media or local shares, though typical vectors include spear-phishing emails containing the malicious attachment.\nThe post-exploitation impact includes unauthorized local code execution, allowing the threat actor to deploy secondary payloads, establish persistence, harvest local credentials, or pivot within the local environment depending on the access rights of the victim process. Remediation requires applying official vendor patches as released by Microsoft to address the underlying memory-handling deficiency in the Word parsing engine."
}