Description

Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-11T17:19:01.980Z",
  "pubdate": "2026-08-11T17:19:01.980Z",
  "executiveSummary": "An off-by-one error vulnerability exists within Microsoft Office Word, specifically affecting the processing of specialized document structures. This vulnerability enables an unauthorized local attacker to successfully execute a local information disclosure attack against targeted systems.\nThe primary risk implication involves the unauthorized exposure of sensitive local memory contents, potentially compromising system confidentiality and exposing data useful for subsequent, more advanced exploitation chains. The attack surface centers on local file handling mechanisms within the application.\nExploitation requires the attacker to have local access to the system and the ability to provision or deliver a specially crafted file designed to trigger the boundary calculation flaw within the vulnerable component.\nThe vulnerability does not inherently grant remote code execution or privilege escalation capabilities based on the provided input, limiting its direct impact strictly to local information disclosure.\nMitigation strategies require applying official vendor updates and patches as soon as they become available, restricting local file execution privileges, and enforcing robust endpoint protection mechanisms to detect anomalous document processing behaviors.",
  "technicalDetails": "The root cause of the vulnerability is an off-by-one arithmetic error residing in the memory management or parsing logic of Microsoft Office Word. An off-by-one error typically occurs when a buffer size calculation or loop boundary condition incorrectly allocates or evaluates memory offsets, usually miscalculating by exactly one byte or index.\nIn the context of this vulnerability, the flaw manifests during the internal handling and parsing of specific internal structures within Microsoft Office Word files. When the application processes the malformed structural elements, the off-by-one calculation leads to an incorrect boundary check.\nThe vulnerable component involves the internal document parsing and rendering subsystems responsible for interpreting file formats within Microsoft Office Word. Because the application fails to properly validate the size and boundaries of input data against allocated buffers, a memory read operation can exceed intended bounds.\nThe attack flow proceeds as follows: First, an unauthorized local attacker crafts or supplies a specialized document containing malformed metadata or structural elements. Second, the victim or the attacker opens this file utilizing the vulnerable version of Microsoft Office Word locally. Third, during the parsing phase, the application evaluates the flawed boundary condition, triggering the off-by-one error.\nAs a direct consequence of the out-of-bounds read condition, adjacent memory contents are inadvertently read or processed by the application. If these adjacent regions contain sensitive data, the flaw facilitates local information disclosure by exposing these contents to the execution context or error-handling paths.\nRegarding authentication and execution requirements, the attack requires local access to the target host. No network exposure is mandated by the core vulnerability mechanics, and the attacker does not require elevated privileges to initiate the local file processing sequence, though local execution capability is necessary.\nPost-exploitation impact is constrained to the extraction of localized memory leakage. The disclosed information may subsequently be leveraged by threat actors to map memory layouts, bypass security controls such as address space layout randomization in multi-stage exploits, or gather sensitive operational data left resident in application memory."
}