CVE-2026-72976 in Office 365
Summary
by MITRE • 09/09/2026
Out-of-bounds read in Microsoft Office Word allows an authorized attacker to disclose information locally.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability described constitutes an out-of-bounds read flaw within the document parsing engine of Microsoft Office Word, specifically affecting how certain file formats are processed during rendering or analysis. This type of memory safety error typically arises when the application fails to properly validate input data before accessing memory buffers allocated for storing document elements such as text, images, or metadata. When a specially crafted Word document is opened, the parser may attempt to read from a memory location that lies outside the boundaries of the intended buffer. While out-of-bounds reads are generally less severe than out-of-bounds writes because they do not allow direct code execution by overwriting control data, they remain critical security risks due to their potential for information disclosure. The attacker must be authorized and local in this context, meaning the vulnerability is triggered when a user with valid credentials on the system opens or interacts with the malicious document, rather than through remote exploitation via email attachments without interaction.
From a technical perspective, this flaw aligns closely with CWE-125, which defines out-of-bounds read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. In the context of Microsoft Office applications, these errors often stem from complex parsing logic that handles legacy formats or specific XML structures within OOXML files. If the application does not correctly calculate the length of a string or array element derived from the document content, it may retrieve sensitive information residing in adjacent memory regions. This could include parts of other open documents, cached credentials, session tokens, or internal application state data that was previously loaded into memory but not cleared after use. The impact is primarily confidentiality-related, as the attacker gains unauthorized access to private system resources without necessarily compromising the integrity or availability of the host machine.
The operational impact centers on local information disclosure, which can serve as a stepping stone for further attacks if combined with other vulnerabilities. Although the initial exploitation requires user interaction and authorized access, the leaked data might reveal enough context to facilitate privilege escalation or lateral movement within an enterprise environment. For instance, disclosing internal IP addresses, active session cookies, or partial memory dumps could aid attackers in mapping network topology or hijacking existing sessions. This behavior is consistent with ATT&CK technique T1005, which covers Data from Local System, where adversaries collect data stored on local devices to support subsequent phases of an intrusion campaign. The requirement for authorization limits the attack surface significantly compared to remote code execution flaws, but it remains a serious concern in environments where users frequently open documents from untrusted or semi-trusted sources within their own workstations.
Mitigation strategies should focus on both technical controls and user awareness. Microsoft has likely released patches addressing this specific parsing logic error, so ensuring that all Office applications are updated to the latest cumulative update is paramount. Administrators should enforce strict patch management policies to minimize exposure windows for known vulnerabilities in productivity suites. Additionally, implementing application control solutions such as Windows Defender Application Control or AppLocker can restrict the execution of untrusted scripts and macros often associated with exploiting document-based flaws. Users must be trained to recognize suspicious file sources and avoid opening documents from unknown senders, even if they appear legitimate. Network segmentation and endpoint detection and response tools should also monitor for anomalous memory access patterns that might indicate exploitation attempts, providing an additional layer of defense against local information disclosure attacks.