Out-of-bounds read in Microsoft Office for macOS and Microsoft Word - CVE-2026-70310

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in Microsoft Office Word when parsing a specially crafted document. A remote attacker can trick the victim into opening a specially crafted document to disclose sensitive information.

The Preview Pane is not an attack vector, and successful exploitation could allow reading small portions of heap memory.

Affected software

How to mitigate CVE-2026-70310

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70310
• https://support.microsoft.com/help/5002901

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office