CVE-2026-56192: Microsoft 365 Apps Information Disclosure

CVE-2026-56192 Overview

CVE-2026-56192 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office that allows an unauthorized attacker to disclose information locally. The flaw affects multiple Office product families, including Microsoft 365 Apps, Office 2016, 2019, 2021, 2024, and SharePoint Server. Exploitation requires user interaction, typically opening a crafted document, and executes in the context of the current user. Successful exploitation exposes memory contents that may contain sensitive information such as file data, tokens, or process memory fragments.

Critical Impact
An attacker who convinces a user to open a malicious Office document can read out-of-bounds memory, potentially exposing sensitive information from the Office process address space.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86) and Microsoft 365 for macOS
Microsoft Office 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft SharePoint Server Subscription Edition, 2016 Enterprise, and 2019

Discovery Timeline

2026-07-14 - CVE-2026-56192 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-56192

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] within Microsoft Office file parsing logic. When Office processes a specifically crafted document, the parser reads memory beyond the bounds of an allocated buffer. This memory disclosure can leak adjacent heap contents to the attacker through document rendering artifacts, embedded content, or downstream processing.

The attack requires local execution context and user interaction, aligning with a typical document-delivery scenario. An attacker crafts a malicious Office file and delivers it via email, file share, or web download. When the victim opens the file, the parser dereferences a memory region outside the intended object, and portions of process memory become accessible to the attacker-controlled logic.

Disclosed memory may contain fragments of other open documents, authentication material, or memory addresses useful for defeating Address Space Layout Randomization (ASLR). This makes the flaw particularly useful as a component of a larger exploit chain, even though it does not directly enable code execution.

Root Cause

The root cause is missing or incorrect bounds validation during parsing of a structured element inside an Office file format. When the parser calculates an offset or length from attacker-controlled fields without verifying that the resulting read falls inside the allocated buffer, the read proceeds into adjacent memory.

Attack Vector

Exploitation requires local access and user interaction. The attacker delivers a malicious document to the target and relies on the user opening it in a vulnerable Office application. No elevated privileges are required, and confidentiality is impacted while integrity and availability are not affected.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in the Microsoft security advisory; see the Microsoft Security Update CVE-2026-56192 for vendor guidance.

Detection Methods for CVE-2026-56192

Indicators of Compromise

Office documents originating from untrusted sources that trigger unusual WINWORD.EXE, EXCEL.EXE, or POWERPNT.EXE child process behavior or crashes
Windows Error Reporting (WER) entries referencing access violations inside Office parsers when opening specific documents
Outbound network connections initiated by Office processes shortly after opening a document, indicating potential exfiltration of leaked memory

Detection Strategies

Monitor Office application telemetry for repeated read access violations and abnormal document parsing errors
Correlate email gateway alerts on macro-enabled or malformed Office files with endpoint document-open events
Hunt for anomalous file reads or memory access patterns performed by Office processes on user endpoints

Monitoring Recommendations

Enable and centralize Microsoft Defender AntiMalware Scan Interface (AMSI) and Office telemetry to identify malicious document activity
Ingest endpoint process, file, and network events into a SIEM or data lake to build detections around Office parser anomalies
Track patch compliance across all Office SKUs listed in the affected products, including macOS installations of Microsoft 365 and Office 2021/2024 LTSC

How to Mitigate CVE-2026-56192

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Update CVE-2026-56192 advisory across all affected Office and SharePoint installations
Prioritize patching endpoints frequently handling external documents, such as executive assistants, finance, and HR workstations
Verify SharePoint Server Subscription Edition, 2016, and 2019 farms receive the corresponding server-side updates

Patch Information

Microsoft has released security updates addressing CVE-2026-56192 through the Microsoft Update channel and Click-to-Run for Microsoft 365 Apps. Administrators should confirm remediation by validating build numbers against the fixed versions listed in the Microsoft Security Response Center advisory.

Workarounds

Enable Protected View and Application Guard for Office to open documents from the internet in an isolated container
Block or quarantine Office documents from external senders at the email gateway until patches are deployed
Configure Attack Surface Reduction (ASR) rules to restrict Office child process creation and limit exploitation impact

bash

# Configuration example: Enforce Protected View for files from the Internet zone via Group Policy registry keys
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f