Description

Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:51.990Z",
  "pubdate": "2026-08-11T17:18:51.990Z",
  "executiveSummary": "An integer underflow vulnerability, also known as an integer wrap or wraparound, has been identified in Microsoft Office. This security flaw enables an unauthorized, local attacker to execute arbitrary code within the context of the user running the vulnerable application.\nThe vulnerability originates from improper arithmetic validation during the processing of data structures within Microsoft Office components. When an arithmetic operation results in a value falling below the minimum representable limit of the integer type, a wrap-around occurs, leading to miscalculated memory allocation sizes or buffer boundary checks.\nIf successfully exploited, this condition allows malicious actors to induce memory corruption, specifically heap-based or stack-based buffer overflows. Consequently, an attacker possessing local access can execute arbitrary payloads, potentially leading to complete system compromise, privilege escalation within the user session, or unauthorized data access.\nExploitation typically requires the target user to open a specially crafted malicious file using an affected version of Microsoft Office. While the attack vector is local, it can be facilitated via remote vectors such as email attachments or malicious downloads, necessitating user interaction to initiate the parsing of the malformed file.",
  "technicalDetails": "The root cause of this vulnerability is an integer underflow condition occurring during the internal parsing of proprietary file formats or embedded data streams within Microsoft Office. Specifically, when the application reads structural size descriptors or length headers from an input file, it fails to adequately validate that the resulting arithmetic calculations do not underflow.\nAn integer wrap occurs when a subtraction operation decreases the value below the minimum limit of the integer data type (e.g., transitioning from zero to a maximum positive integer in unsigned representations, or resulting in an unexpected negative value in signed interpretations). When this flawed integer is subsequently utilized as a parameter in memory allocation routines—such as malloc() or HeapAlloc()—the system allocates a significantly smaller buffer than required by the subsequent data copy operation.\nThe attack flow proceeds as follows: First, the unauthorized local attacker crafts a malicious file containing manipulated length or size headers designed to trigger the arithmetic underflow during parsing. Second, the victim opens this file using the vulnerable Microsoft Office application. Third, the internal parser reads the malicious headers and performs the vulnerable arithmetic operation, resulting in an unvalidated, wrapped integer size.\nFourth, the application allocates a constrained memory buffer based on the wrapped value. Fifth, when the parser attempts to read the full data stream into this undersized buffer, a classic buffer overflow occurs, overwriting adjacent heap or stack memory structures with controlled or semi-controlled attacker data.\nFinally, by carefully arranging heap contents or manipulating execution pointers via overwritten metadata, the attacker achieves arbitrary code execution. The privileges required for this attack are minimal, as local execution is performed under the security context of the locally logged-in user running the affected Microsoft Office suite. Network exposure is indirect, relying on the delivery mechanism of the crafted file."
}