CVE-2026-56195 Overview
CVE-2026-56195 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office that enables local information disclosure. An unauthorized attacker can read memory outside the intended buffer boundaries when a user opens a specially crafted document. Successful exploitation exposes sensitive process memory contents to the attacker.
The vulnerability affects multiple Office versions including Microsoft 365 Apps, Office 2016, Office 2019, Office 2021, and Office 2024 across Windows and macOS platforms. Exploitation requires user interaction to open a malicious file. Microsoft has published a security advisory addressing this issue through the Microsoft Security Response Center.
Critical Impact
Attackers can read sensitive memory contents from the Office process, potentially exposing document data, cached credentials, or memory addresses useful for chaining with other exploits.
Affected Products
- Microsoft 365 Apps (Enterprise, x64 and x86)
- Microsoft 365 for macOS
- Microsoft Office 2016, 2019, 2021, and 2024 (including LTSC and macOS editions)
Discovery Timeline
- 2026-07-14 - CVE-2026-56195 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-56195
Vulnerability Analysis
The vulnerability is an out-of-bounds read condition [CWE-125] within Microsoft Office file parsing logic. When Office processes a crafted document, the application reads memory beyond the allocated buffer boundary. This exposes adjacent memory contents to the attacker-controlled context.
Information disclosure vulnerabilities of this class often reveal heap layout information, pointer values, or fragments of previously processed documents. Attackers commonly chain such flaws with memory corruption bugs to defeat Address Space Layout Randomization (ASLR). The EPSS score is 0.382% (percentile 30.5), indicating a low current probability of exploitation activity.
Root Cause
The root cause is missing or improper bounds checking during document parsing. Office fails to validate that a read operation stays within the allocated buffer when processing structured elements of a crafted file. When the parser encounters malformed size fields or offsets, it dereferences memory outside the intended region.
Attack Vector
Exploitation requires local access and user interaction. The attacker delivers a malicious Office document through email, file sharing, or web download. When the victim opens the file in an affected Office application, the parsing routine triggers the out-of-bounds read. The disclosed memory contents must then be exfiltrated, typically through embedded macros, external references, or side-channel returns to the attacker.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update Guide for CVE-2026-56195 for vendor technical details.
Detection Methods for CVE-2026-56195
Indicators of Compromise
- Unexpected Office application crashes or hangs immediately after opening documents from untrusted sources
- Office processes spawning unusual child processes or making outbound network connections after opening a document
- Documents containing malformed structured storage streams, oversized headers, or anomalous embedded objects
Detection Strategies
- Monitor winword.exe, excel.exe, and powerpnt.exe for abnormal memory access patterns and crash telemetry
- Inspect inbound email attachments and downloaded documents with static analyzers that flag malformed Office file structures
- Correlate document open events with subsequent network egress or credential access activity
Monitoring Recommendations
- Enable Microsoft Defender attack surface reduction rules that block Office child process creation and untrusted executable content
- Aggregate Office application telemetry, endpoint process events, and email gateway logs in a central SIEM for correlation
- Alert on Office processes reading from or writing to unusual file system paths shortly after document parsing
How to Mitigate CVE-2026-56195
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-56195 to all affected Office installations
- Prioritize patching endpoints that handle documents from external sources such as email gateways and shared file services
- Verify that Microsoft 365 Apps clients are on a supported update channel and have received the current monthly update
Patch Information
Microsoft has released updates for Microsoft 365 Apps, Microsoft 365 for macOS, and Office 2016, 2019, 2021, and 2024. Administrators should deploy the fixes through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or the Office Click-to-Run channel. Consult the vendor advisory for exact build numbers per product edition.
Workarounds
- Enable Protected View for documents originating from the internet and other untrusted locations
- Configure Office File Block policy to prevent opening legacy binary file formats from untrusted sources
- Restrict opening of Office attachments from unknown senders through email gateway policies and user awareness training
# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
