Description

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-11T17:19:08.283Z",
  "pubdate": "2026-08-11T17:19:08.283Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in Microsoft Office Word, which can be leveraged by an unauthorized local attacker to achieve information disclosure. The flaw resides within the document parsing engine of Microsoft Office Word, specifically during the handling and processing of malformed or specially crafted document structures. Successful exploitation of this vulnerability allows an adversary to read sensitive memory contents, potentially exposing critical system or user data residing in adjacent memory regions. The risk implication centers on unauthorized information disclosure, which can facilitate subsequent targeted attacks or the bypass of localized security controls. Attacker capabilities are restricted to local access, requiring the target user to open a maliciously crafted file or otherwise interact with the vulnerable application component. No specific exploitation requirements beyond local file execution or user interaction are explicitly detailed in the baseline description, but standard local attack vectors apply.",
  "technicalDetails": "The vulnerability is classified as an out-of-bounds read, stemming from improper input validation and boundary checks within the memory management routines of Microsoft Office Word. The vulnerable component is responsible for parsing internal file formats and rendering document elements. When Microsoft Office Word processes a maliciously crafted document containing corrupted length specifiers or out-of-range structural offsets, the parsing engine fails to properly validate boundary constraints prior to executing read operations against internal buffers.\nThe root cause lies in the application trusting untrusted integer values parsed directly from the file structure, leading to memory access operations that exceed the allocated boundaries of the target buffer. During the attack flow, the adversary delivers a specially crafted file to the local system. When the user opens this file using Microsoft Office Word, the application initiates parsing of the malicious document structures. The parser calculates memory offsets based on the corrupted metadata provided within the file format, resulting in pointers referencing memory locations outside the bounds of the legitimate data structures.\nAs the application reads from these invalid memory addresses, sensitive data stored adjacently on the heap or stack is inadvertently accessed and potentially echoed back into application states or error logs. Because the vulnerability is strictly an out-of-bounds read, it does not inherently permit arbitrary code execution or memory modification; however, the leaked information may include memory addresses, cryptographic secrets, or sensitive user data that can be utilized to defeat exploit mitigations such as Address Space Layout Randomization in secondary attacks.\nThe attack requires local access to the target host and relies on user interaction, specifically tricking a user into opening the malformed file with Microsoft Office Word. The vulnerable component operates within the user privilege context of the account executing the application. Authentication requirements are non-applicable as the execution occurs locally via file processing. Network exposure is not a direct vector for this specific local information disclosure flaw, relying instead on local file transport or email delivery mechanisms to place the document on the target system."
}