Out-of-bounds read in Microsoft Office for macOS - CVE-2026-62842

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the Microsoft Office graphics component when parsing a specially crafted file. A remote attacker can trick the victim into opening a crafted file to disclose sensitive information.

The disclosed information may include portions of process memory. The Preview Pane is not an attack vector for this vulnerability.

Affected software

How to mitigate CVE-2026-62842

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-62842
• https://go.microsoft.com/fwlink/p/?linkid=831049

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office