CVE-2026-50665: Microsoft 365 Apps Disclosure Vulnerability

CVE-2026-50665 Overview

CVE-2026-50665 is an out-of-bounds read vulnerability [CWE-125] affecting multiple versions of Microsoft Office. The flaw allows an unauthorized attacker to disclose information locally when a user opens a specially crafted document. Exploitation requires user interaction, and the attacker gains access to unintended memory contents within the Office process.

Microsoft published the advisory on July 14, 2026, and last updated the record on July 16, 2026. The vulnerability affects Microsoft 365 Apps, Microsoft 365 for macOS, Office 2016, Office 2019, Office 2021 (including macOS LTSC), and Office 2024 (including macOS LTSC).

Critical Impact
Successful exploitation leaks limited process memory contents to a local attacker, which may include sensitive data useful for chaining with other vulnerabilities.

Affected Products

Microsoft 365 Apps (Enterprise x86 and x64)
Microsoft 365 for macOS
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows and macOS)

Discovery Timeline

2026-07-14 - CVE-2026-50665 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-50665

Vulnerability Analysis

The vulnerability is an out-of-bounds read condition classified under [CWE-125]. When Microsoft Office parses a malformed document, the affected code path reads memory outside the bounds of the allocated buffer. The attacker uses this behavior to disclose contents of adjacent memory regions within the Office process.

The issue requires local access and user interaction. A victim must open a crafted file delivered through email, a network share, or a web download. The scope remains unchanged, and only confidentiality is impacted. Integrity and availability of the target system are not affected.

The EPSS score is 0.35% at the time of publication, indicating a low near-term exploitation probability. No public proof-of-concept code or exploitation activity has been observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing or insufficient bounds checking in a file parsing routine within Microsoft Office. The parser processes fields inside document structures without validating that the length or offset values remain within the allocated buffer. Microsoft has not published detailed technical analysis of the affected component. See the Microsoft Security Update Guide CVE-2026-50665 for vendor details.

Attack Vector

Exploitation requires an attacker to craft a malicious Office document and deliver it to a target user. The victim must open the file in a vulnerable version of Office. When the parser reaches the malformed structure, it reads memory beyond the intended buffer boundary. The attacker retrieves the leaked contents through visible document artifacts or downstream telemetry embedded in the file. Because privileges are not required and the flaw is triggered locally, the primary risk is targeted phishing or malicious document distribution.

Detection Methods for CVE-2026-50665

Indicators of Compromise

Unexpected Office documents received from untrusted external senders, particularly with unusual file structures or embedded objects
Office processes (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) crashing or generating Watson error reports after opening a document
Outbound network connections initiated by Office processes shortly after a document is opened, indicating potential exfiltration of leaked data

Detection Strategies

Inspect inbound email attachments and web downloads for malformed Office file structures using static file analysis and sandbox detonation
Monitor endpoint telemetry for Office process anomalies including access violations, exception handlers firing during document parsing, and unusual child process creation
Correlate document open events with subsequent memory read exceptions logged by Windows Error Reporting

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and executable content
Forward Office application crash dumps and event logs to a centralized SIEM for retrospective analysis
Track patch compliance across all Office installations to identify unpatched hosts vulnerable to CVE-2026-50665

How to Mitigate CVE-2026-50665

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide CVE-2026-50665 advisory
Prioritize patching for users who routinely handle external documents, including finance, HR, and executive assistants
Verify Microsoft 365 Apps update channels are configured to receive security updates automatically

Patch Information

Microsoft has published fixes through its regular update channels. Refer to the Microsoft Security Update Guide CVE-2026-50665 for the specific build numbers per product and channel. Both Windows and macOS versions of Microsoft 365 and Office LTSC receive updates.

Workarounds

Enable Protected View for documents originating from the internet and other untrusted locations to limit parser exposure
Configure Office File Block policies to prevent opening legacy or high-risk file formats from untrusted sources
Train users to avoid opening unsolicited Office attachments and to report suspicious documents to the security team

bash

# Enable Protected View via Group Policy registry keys for Word
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f