CVE-2026-80090 in Office
Summary
by MITRE • 09/09/2026
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability described constitutes a critical security flaw within the document parsing engine of Microsoft Office Word, specifically categorized as an out-of-bounds read condition. This type of memory corruption error occurs when the application attempts to access data at a memory address that lies outside the boundaries of the intended buffer or array structure. In the context of word processing software, this typically happens during the rendering or interpretation of complex document elements such as embedded objects, specific formatting codes, or malformed metadata structures within a .docx file. When an attacker crafts a malicious Word document containing specially constructed data that triggers this boundary violation, the application fails to properly validate input lengths before reading from memory. This lack of rigorous bounds checking allows the program to retrieve sensitive information stored in adjacent memory locations, which may contain stack variables, heap metadata, or other process-specific data that was not intended for disclosure.
From a technical perspective, this flaw aligns with CWE-125, Out-of-bounds Read, and is often associated with CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. The operational impact of such a vulnerability extends beyond simple information leakage; while the primary vector described involves disclosing information over a network, out-of-bounds reads can sometimes be leveraged as part of a larger attack chain leading to remote code execution if combined with other memory corruption techniques like heap spraying or specific return-oriented programming exploits. However, in its current manifestation, it primarily serves as an information disclosure mechanism that allows unauthorized attackers to exfiltrate data from the victim's system memory through network channels. This could potentially reveal cryptographic keys, session tokens, user credentials, or internal application states that facilitate further lateral movement within a corporate network environment.
The attack vector for this vulnerability is typically remote and requires social engineering elements such as convincing a user to open a maliciously crafted document sent via email or downloaded from an untrusted source. Once the file is opened in Microsoft Office Word, the parsing engine processes the malformed content, triggering the out-of-bounds read condition without requiring any additional privileges on the target system. This aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, if used for initial access, but more directly relates to data exfiltration techniques where sensitive information is gathered from local systems before being transmitted externally. The ability to disclose this information over a network indicates that the vulnerability can be exploited in an automated manner against multiple targets simultaneously, increasing its severity rating significantly within enterprise environments.
Mitigation strategies for this vulnerability must focus on both immediate patching and long-term defensive posture improvements. Organizations should immediately apply the latest security updates provided by Microsoft Office to ensure the parsing engine includes proper bounds checking logic. Beyond patching, implementing application control policies such as Windows Defender Application Control or AppLocker can prevent unauthorized versions of Word from executing untrusted documents. Additionally, deploying network intrusion detection systems configured with signatures for known exploitation patterns related to document-based memory corruption attacks can help identify and block attempts to exploit this flaw in real-time. Users should be trained to recognize suspicious attachments and avoid opening files from unknown sources, while IT administrators should restrict macro execution by default to reduce the attack surface associated with Office documents. Regular vulnerability scanning and penetration testing of internal systems will also help ensure that any residual exposure is identified and remediated promptly before it can be leveraged for malicious purposes.