CVE-2026-102867: Microsoft 365 Apps Information Disclosure

CVE-2026-102867 Overview

CVE-2026-102867 is an out-of-bounds read vulnerability in Microsoft Office Word that allows an unauthorized attacker to disclose information over a network. The flaw is categorized under [CWE-20] Improper Input Validation and affects multiple supported Office versions including Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC. Exploitation requires user interaction, typically opening a specially crafted document. Successful exploitation leads to disclosure of sensitive in-process memory contents without requiring authentication to the target system.

Critical Impact
An attacker who tricks a user into opening a malicious Word document can read memory outside allocated buffer boundaries and exfiltrate sensitive information processed by Microsoft Word.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office LTSC 2021 (x64 and x86)
Microsoft Office LTSC 2024 (x64 and x86)

Discovery Timeline

2026-10-13 - CVE-2026-102867 published to the National Vulnerability Database
2026-10-14 - Last updated in the NVD database

Technical Details for CVE-2026-102867

Vulnerability Analysis

The vulnerability resides in how Microsoft Word parses structured document content. When Word processes a malformed element in a specially crafted file, it reads memory beyond the bounds of the allocated buffer. The out-of-bounds read exposes adjacent process memory, which can include heap metadata, pointers, and residual document data from prior operations.

The issue is a confidentiality-only exposure. Integrity and availability of the target system remain unaffected, but leaked memory may contain data useful for subsequent exploitation such as address space layout information or sensitive user content. The vulnerability has an EPSS probability of 0.876% (58.176 percentile) as of 2026-10-15.

Root Cause

The root cause is improper input validation ([CWE-20]) in Word's document parsing logic. Specific size or offset fields in the file format are trusted without proper bounds checking, allowing a crafted document to drive read operations past the end of a legitimately allocated buffer. Microsoft has not published additional technical detail beyond the advisory.

Attack Vector

The attack vector is network-adjacent through document delivery. An attacker crafts a malicious Word document and delivers it via email attachment, link to a hosted file, SharePoint, OneDrive, or any other file sharing channel. The victim must open the document in a vulnerable Word client. Preview Pane rendering may also trigger the parsing path in some configurations. Once opened, Word processes the malformed element and leaks memory contents, which an attacker can retrieve through covert channels embedded in the document response or through follow-on telemetry.

No public proof-of-concept exploit is listed in Exploit-DB, and the CISA Known Exploited Vulnerabilities catalog does not currently include this CVE.

Detection Methods for CVE-2026-102867

Indicators of Compromise

Inbound email messages containing .docx, .doc, .rtf, or .docm attachments from untrusted or newly registered sender domains.
Word process (WINWORD.EXE) spawning unexpected child processes or initiating outbound network connections immediately after opening a document.
Office telemetry showing document parsing exceptions, crashes, or memory faults in wwlib.dll or related Word components.

Detection Strategies

Deploy mail gateway and sandbox detonation for inbound Office documents, focusing on malformed structured storage streams and oversized record lengths.
Monitor endpoint telemetry for WINWORD.EXE crashes correlated with the opening of attachments from external senders.
Hunt for outbound DNS or HTTPS beacons originating from Office processes shortly after document open events.

Monitoring Recommendations

Enable Microsoft Defender for Office 365 Safe Attachments and Safe Links policies, where available.
Collect and retain Office application event logs along with process creation events (Windows Event ID 4688 or Sysmon Event ID 1) in a centralized data lake.
Alert on documents originating from the Internet zone that trigger macro execution or external template loading.

How to Mitigate CVE-2026-102867

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Update Guide CVE-2026-102867 advisory to all affected Office installations.
Inventory endpoints running Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC to confirm patch deployment status.
Restrict delivery of Office documents from external senders at the mail gateway until patches are confirmed deployed.

Patch Information

Microsoft has released fixed builds for Microsoft 365 Apps, Office LTSC 2021, and Office LTSC 2024. Refer to the Microsoft Security Update Guide CVE-2026-102867 for exact build numbers and update channels. Click-to-Run installations receive updates through standard Office update servicing.

Workarounds

Disable the Outlook Preview Pane for messages containing attachments to prevent inadvertent rendering of malicious documents.
Enforce Protected View for files originating from the Internet, email attachments, and unsafe locations through Group Policy.
Block or restrict macro execution for documents from the Internet using the "Block macros from running in Office files from the Internet" policy.

bash

# Example Group Policy registry values to enforce Protected View in Word
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f