CVE-2026-80079 in Office
Summary
by MITRE • 09/09/2026
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an out-of-bounds read within Microsoft Office Word represents a critical memory safety flaw that compromises the confidentiality of system data through remote exploitation vectors. This specific type of error occurs when the application attempts to access memory locations beyond the intended boundaries of a buffer or array, typically due to insufficient validation of input parameters during the parsing and rendering processes of document files. In the context of Microsoft Office Word, this often involves malformed or specially crafted documents that trigger incorrect pointer arithmetic or boundary checks within the underlying rendering engine. When such conditions are met, the application reads data from adjacent memory regions that were not intended for disclosure, potentially exposing sensitive information stored in those locations to an attacker who has successfully triggered the vulnerability through a network-based attack vector.
From a technical perspective, this flaw aligns with Common Weakness Enumeration (CWE) category CWE-125, which describes Out-of-bounds Read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. The operational impact is primarily focused on information disclosure rather than immediate code execution or system compromise, although such flaws can sometimes serve as stepping stones for more severe attacks if combined with other techniques like heap spraying to achieve arbitrary read primitives. An unauthorized attacker could exploit this weakness by distributing a malicious document via email attachments, shared network drives, or web-based file hosting services. Upon opening the crafted file in a vulnerable version of Microsoft Office Word, the application processes specific elements such as complex formulas, embedded objects, or specialized formatting instructions that trigger the memory access violation. The resulting disclosure may include stack contents, heap metadata, or other sensitive data residing in the process memory space, which could potentially be leveraged to bypass security mitigations like Data Execution Prevention (DEP) or Address Space Layout Randomization (ASLR).
This vulnerability is closely associated with ATT&CK technique T1059.006, specifically PowerShell execution if scripting components are involved, but more accurately maps to T1203 Exploitation for Client Executable Abuse when considering the delivery mechanism of malicious documents. The attack pattern typically involves social engineering tactics where users are persuaded to open a seemingly legitimate document that contains hidden payloads designed to trigger the memory corruption flaw. Once triggered, the out-of-bounds read allows the attacker to extract data from the victim's machine without direct authentication or prior access privileges, effectively turning a standard office application into an information leak channel over the network. This underscores the risk associated with rich text processing engines that must handle untrusted input while maintaining complex state and memory structures.
Mitigation strategies for this vulnerability primarily rely on timely patching of Microsoft Office components to address the underlying code defects responsible for the boundary check failures. Organizations should enforce strict policies regarding the opening of documents from unknown or untrusted sources, utilizing application control solutions such as AppLocker or Windows Defender Application Control to restrict execution of potentially malicious scripts and macros embedded within files. Additionally, enabling Protected View by default ensures that documents opened from internet zones are rendered in a sandboxed environment with limited permissions, thereby preventing direct interaction with system resources even if the vulnerability is triggered. Regular security awareness training for end-users remains essential to reduce the likelihood of successful social engineering attempts that lead to the execution of these malicious payloads.