CVE-2026-56193: Microsoft 365 Apps Information Disclosure

CVE-2026-56193 Overview

CVE-2026-56193 is an out-of-bounds read vulnerability in Microsoft Office that permits local information disclosure. An unauthenticated attacker can craft a malicious Office document that, when opened by a user, causes the application to read memory outside the intended buffer. The condition is classified under [CWE-125] and affects Microsoft 365 Apps, Microsoft 365 for macOS, and Office 2016, 2019, 2021, and 2024 across x86, x64, and macOS builds. Exploitation requires user interaction and local access, and no public exploit code or in-the-wild activity has been reported. Microsoft has published guidance and an update through its Security Response Center.

Critical Impact
A successful attack leaks small amounts of process memory from Office, which can expose sensitive data such as document contents, tokens, or memory addresses useful for chaining further exploits.

Affected Products

Microsoft 365 Apps (x86 and x64, Enterprise)
Microsoft 365 for macOS
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (x86, x64, macOS)

Discovery Timeline

2026-07-14 - CVE-2026-56193 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-56193

Vulnerability Analysis

The issue is an out-of-bounds read in Microsoft Office file parsing logic. When Office loads a specially crafted document, the parser reads bytes past the boundary of an allocated buffer. The out-of-bounds bytes are then consumed by downstream logic, and portions of adjacent memory can be reflected back to the attacker or otherwise disclosed to a local context.

The attack is local because the malicious file must be delivered to and opened on the target machine, and user interaction is required. Confidentiality impact is limited to information available in the Office process address space. The vulnerability does not permit modification of data or denial of service on its own, but attackers frequently combine information disclosure primitives with memory corruption bugs to bypass mitigations such as Address Space Layout Randomization (ASLR).

Root Cause

The root cause is missing or incorrect validation of a length or index value taken from attacker-controlled document structures. The parser trusts a size field, offset, or count during structured document processing and reads beyond the allocated object. This matches the [CWE-125] Out-of-Bounds Read pattern.

Attack Vector

Exploitation requires an attacker to deliver a crafted Office document, typically through phishing, shared file storage, or a compromised web download. The victim opens the document in a vulnerable version of Word, Excel, PowerPoint, or another Office component. On open, the parser triggers the out-of-bounds read, and leaked memory contents can be exfiltrated via document logic, embedded scripts, or observed error output. See the Microsoft Security Update for CVE-2026-56193 for vendor technical details.

No public proof-of-concept code was available at the time of publication.

Detection Methods for CVE-2026-56193

Indicators of Compromise

Office documents delivered from untrusted senders that trigger unexpected crashes, hangs, or Watson error reports in winword.exe, excel.exe, or powerpnt.exe.
Presence of malformed OOXML or legacy binary Office files with anomalous structure sizes, oversized records, or truncated streams.
Office processes spawning secondary readers or exhibiting anomalous outbound network activity shortly after a document is opened.

Detection Strategies

Alert on Office application crashes correlated with recently opened attachments, using Windows Error Reporting and application crash telemetry.
Inspect email and file-sharing gateways for Office documents with structural anomalies that deviate from format specifications.
Correlate document-open events with subsequent unusual memory access patterns or child process creation from Office binaries.

Monitoring Recommendations

Ensure endpoint telemetry captures document-open events, process crashes, and image loads for Office components.
Track Office build versions across the fleet to confirm that patched versions are deployed.
Monitor mail flow for high-volume delivery of Office documents to users likely to open them, such as HR, finance, and executive assistants.

How to Mitigate CVE-2026-56193

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-56193 to all affected Office and Microsoft 365 installations.
Verify that Click-to-Run and Microsoft 365 Apps clients have received the current update channel build.
Prioritize patching for users who routinely receive external Office documents.

Patch Information

Microsoft has released updates addressing CVE-2026-56193 for Microsoft 365 Apps, Microsoft 365 for macOS, and Office 2016, 2019, 2021 LTSC, and 2024 LTSC. Refer to the Microsoft Security Update Guide for KB numbers, affected builds, and download links specific to each product and platform.

Workarounds

Open documents from untrusted sources in Protected View or Application Guard for Office to contain any memory disclosure to a sandboxed process.
Enforce Office macro and Active Content restrictions via Group Policy to reduce the value of leaked memory to attackers.
Restrict opening of legacy binary Office formats through File Block policy where business processes permit.

bash

# Configuration example: enable Protected View for files from the Internet, Outlook attachments, and unsafe locations
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f