CVE-2026-66806 Overview
CVE-2026-66806 is an off-by-one error in Microsoft Office Word that permits local information disclosure. The flaw is classified under [CWE-125] (Out-of-bounds Read) and requires user interaction to trigger. An attacker crafts a malicious Word document that, when opened by a victim, causes Word to read memory beyond an intended buffer boundary. The condition exposes sensitive process memory contents to the attacker-controlled document context. Microsoft published the advisory on August 11, 2026.
Critical Impact
Successful exploitation exposes confidential in-process memory from Microsoft Word, potentially including document content, credentials, or other sensitive data held in memory at the time the malicious file is opened.
Affected Products
- Microsoft Office Word (specific builds enumerated in the Microsoft Security Response Center advisory)
- Refer to the Microsoft CVE-2026-66806 Advisory for the authoritative list of affected versions
Discovery Timeline
- 2026-08-11 - CVE-2026-66806 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-66806
Vulnerability Analysis
The vulnerability is an off-by-one error in Microsoft Office Word's document parsing logic. Off-by-one errors occur when a loop or index calculation reads one element past the intended end of a buffer. In this case, Word reads a single byte or structure element outside the allocated bounds, which maps to [CWE-125] Out-of-bounds Read.
The out-of-bounds read exposes adjacent memory to the parsing routine. That memory can be surfaced through document rendering, field values, or error state accessible to the attacker's crafted content. Because the impact is confidentiality-only, the flaw does not permit code execution or data modification through this primitive alone.
Exploitation is local and requires the target user to open a malicious document. The EPSS score is 0.529% with a percentile of 42.1, reflecting a low probability of observed exploitation in the near term.
Root Cause
The root cause is an incorrect boundary calculation in a Word parser. A length or index computation permits access to one position beyond the valid range of an in-memory structure. The resulting read returns uninitialized or unrelated heap memory to the calling routine, which then incorporates that data into processing accessible to the document.
Attack Vector
An attacker delivers a crafted Word document by email, file share, or web download. When the user opens the file, Word parses the malformed structure and triggers the off-by-one read. The disclosed memory is returned to the document context, where the attacker can exfiltrate it through document fields, macro output, or subsequent interaction.
No verified proof-of-concept code is publicly available. See the Microsoft CVE-2026-66806 Advisory for vendor technical details.
Detection Methods for CVE-2026-66806
Indicators of Compromise
- Unexpected Word documents received from external senders containing malformed structures or unusual embedded objects
- Word process (WINWORD.EXE) crashes or unexpected memory access exceptions logged in Windows Event Viewer around document open events
- Outbound network connections from WINWORD.EXE shortly after opening an untrusted document
Detection Strategies
- Inspect email and file gateway logs for Word documents originating from untrusted sources and correlate with endpoint document-open telemetry
- Monitor for anomalous child processes or scripting hosts spawned from WINWORD.EXE, which may indicate follow-on activity after information disclosure
- Apply behavioral rules to flag Word processes making outbound HTTP or SMB connections immediately after opening a document
Monitoring Recommendations
- Enable Microsoft Office telemetry and forward WINWORD.EXE process and file-open events to a centralized SIEM for correlation
- Track Windows Error Reporting events referencing Word memory faults, which can indicate exploitation attempts or unstable exploit payloads
- Baseline normal Word network egress and alert on deviations, particularly to newly registered or low-reputation domains
How to Mitigate CVE-2026-66806
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-66806 Advisory to all Word installations
- Enforce Protected View for documents originating from the internet and email attachments
- Instruct users to avoid opening unsolicited Word documents and to report suspicious attachments to the security team
Patch Information
Microsoft published the security update on August 11, 2026. Administrators should deploy the update via Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or Configuration Manager. Consult the Microsoft CVE-2026-66806 Advisory for the specific KB article and build numbers that correspond to each supported Word channel.
Workarounds
- Configure Group Policy to open documents from untrusted locations in Protected View, which sandboxes parsing and reduces the impact of the out-of-bounds read
- Block or quarantine .doc, .docx, and .rtf attachments from external senders at the email gateway until the patch is deployed
- Disable rendering of embedded content and dynamic fields in Word documents through the Trust Center for high-risk user populations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
