CVE-2026-62842: Microsoft 365 Apps Information Disclosure

CVE-2026-62842 Overview

CVE-2026-62842 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office that allows an unauthorized attacker to disclose information locally. The flaw affects Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021, and Office 2024. Successful exploitation requires user interaction, typically opening a specially crafted document. The vulnerability exposes sensitive process memory but does not permit modification of data or disruption of service.

Critical Impact
Attackers can read out-of-bounds memory in Microsoft Office processes, potentially disclosing sensitive information including memory addresses, document contents, or data useful for chaining with other exploits.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows x64/x86 and macOS)

Discovery Timeline

2026-08-11 - CVE-2026-62842 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62842

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in Microsoft Office file parsing logic. When Office processes a malformed document, code reads memory beyond the intended buffer boundary. The attacker who supplies the document can obtain the contents of adjacent memory regions inside the Office process. Impact is limited to confidentiality — the flaw does not corrupt memory or allow code execution on its own. However, disclosed memory can defeat Address Space Layout Randomization (ASLR) and support follow-on exploitation when chained with a memory-write primitive.

Root Cause

The root cause is missing or insufficient bounds checking on structured fields within an Office document format. When a crafted file specifies an offset or length larger than the allocated buffer, the parser dereferences memory outside the intended range and returns those bytes to caller logic that later exposes them through document content, error paths, or rendered output.

Attack Vector

Exploitation requires local access and user interaction. The attacker delivers a crafted Office document — commonly through phishing email, malicious web download, or a shared file service. When a user opens the file in a vulnerable Office application, the parser triggers the out-of-bounds read. No elevated privileges are needed by the attacker prior to exploitation. Because the CVSS vector specifies confidentiality impact only, no code execution or file modification occurs directly through this flaw.

No public proof-of-concept exploit is available at time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft CVE-2026-62842 Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-62842

Indicators of Compromise

Office documents (.docx, .xlsx, .pptx, .rtf, or legacy binary formats) delivered from untrusted senders or unusual external domains.
Unexpected Office application crashes, hangs, or repeated Watson error reports following the opening of a specific document.
Office processes (winword.exe, excel.exe, powerpnt.exe) spawning unusual child processes or performing outbound network connections shortly after document open.

Detection Strategies

Inspect email gateways and web proxies for Office document attachments and correlate with sender reputation and file provenance.
Monitor for anomalous Office process behavior, including memory access violations logged in the Windows Application event log.
Deploy YARA rules that identify malformed structural fields in Office file formats known to trigger boundary violations.

Monitoring Recommendations

Enable Microsoft Defender attack surface reduction (ASR) rules that block Office from creating child processes and from injecting code.
Forward Office telemetry, Windows Error Reporting, and endpoint EDR events to a central data lake for correlation across users and documents.
Track document open events on high-value users and flag files opened from Downloads, Temp, or Outlook attachment paths.

How to Mitigate CVE-2026-62842

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-62842 Advisory across all affected Windows and macOS Office installations.
Verify Microsoft 365 Apps update channels are current and confirm Office 2019, 2021 LTSC, and 2024 LTSC builds match the patched revisions.
Reinforce user awareness for documents from external sources and require Protected View for internet-origin files.

Patch Information

Microsoft has published a security update through the Microsoft Security Response Center. Administrators should consult the Microsoft CVE-2026-62842 Advisory for exact build numbers per channel and deploy via Microsoft Update, Configuration Manager, Intune, or macOS AutoUpdate.

Workarounds

Enforce Protected View and Office Application Guard for documents originating from the internet or email attachments.
Block or quarantine legacy Office binary formats at the mail gateway when business processes do not require them.
Restrict Office macro execution and disable OLE content activation via Group Policy where feasible.

bash

# Enforce Protected View for internet-origin Office files via registry (per-user)
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f