Out-of-bounds read in Microsoft Office - CVE-2026-70263

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in Microsoft Office Word when accessing heap memory. A remote attacker can exploit this issue over a network to disclose sensitive information.

Exploitation requires user interaction. The disclosed information may include small portions of heap memory. The Preview Pane is not an attack vector.

Affected software

How to mitigate CVE-2026-70263

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70263
• https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows