CVE-2026-66809: Microsoft Office Information Disclosure

CVE-2026-66809 Overview

CVE-2026-66809 is an out-of-bounds read vulnerability in Microsoft Office that allows an unauthorized local attacker to disclose sensitive information. The flaw is tracked under CWE-125 and requires user interaction to trigger, typically by opening a crafted Office document.

Successful exploitation exposes process memory contents that may include sensitive data, security tokens, or address information useful for chaining with other vulnerabilities. Microsoft has published guidance in the Microsoft Security Advisory.

Critical Impact
An attacker who convinces a user to open a specially crafted Office file can read memory outside intended buffer boundaries and disclose confidential information from the Office process.

Affected Products

Microsoft Office (specific versions listed in the vendor advisory)

Discovery Timeline

2026-08-11 - CVE-2026-66809 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-66809

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] within Microsoft Office. When Office parses a specially crafted document, the code reads memory beyond the intended buffer boundary. The disclosed bytes can contain fragments of heap memory, pointer values, or other data resident in the Office process address space.

The attack requires local access and user interaction. A user must open the malicious document for exploitation to occur. Exploitation affects confidentiality only. Integrity and availability of the host remain unaffected according to the CVSS vector.

Information disclosure vulnerabilities of this class are frequently combined with memory corruption flaws. Leaked pointer values can defeat Address Space Layout Randomization (ASLR), enabling reliable follow-on code execution exploits.

Root Cause

The root cause is missing or inadequate bounds validation when Office parses a structured field within a document format. The parser reads beyond the allocated buffer, returning adjacent memory to the caller. Microsoft has not published detailed root-cause analysis at the time of writing.

Attack Vector

Exploitation proceeds through a standard document delivery chain. An attacker crafts an Office document that triggers the out-of-bounds read during parsing. The attacker delivers the file through email, a file share, or a phishing link. The user opens the file in a vulnerable version of Office, and the parser reads uninitialized memory. The disclosed data can be exfiltrated through embedded content, active-content channels, or covert side channels within the document.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in the Microsoft Security Advisory.

Detection Methods for CVE-2026-66809

Indicators of Compromise

Office documents from untrusted senders that contain unusual embedded objects, malformed structured storage streams, or non-standard OLE parts.
Office processes (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) generating unexpected outbound network connections shortly after document open.
Crash dumps or Windows Error Reporting (WER) events referencing Office parsing modules with access violation reads.

Detection Strategies

Inspect inbound email attachments and file shares for Office documents with malformed record structures using content disarm and reconstruction (CDR) tooling.
Correlate Office child process creation and network egress with recent document open events to identify anomalous post-open behavior.
Hunt for repeated Office process crashes across endpoints, which can indicate exploitation attempts against parsing code paths.

Monitoring Recommendations

Enable Microsoft Defender attack surface reduction (ASR) rules that block Office from creating child processes and from creating executable content.
Forward Office telemetry, Sysmon EventID 1 (process creation) and EventID 3 (network connection), and WER data to a centralized data lake for correlation.
Track user reports of unexpected document behavior and correlate them with endpoint telemetry to surface targeted delivery campaigns.

How to Mitigate CVE-2026-66809

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Advisory across all Office installations.
Enforce Protected View for documents originating from the internet and email attachments so untrusted files open in a sandboxed context.
Restrict macros and active content on Office documents received from external senders through Group Policy.

Patch Information

Microsoft has released updates addressing CVE-2026-66809. Administrators should consult the Microsoft Security Advisory to identify the specific KB articles and Click-to-Run channel builds applicable to their deployment. Deploy through Windows Update, Microsoft Update, Microsoft Configuration Manager, or Intune.

Workarounds

Configure Office File Block policy to prevent opening legacy or high-risk file formats from untrusted locations until patches are deployed.
Enable Protected View for all files originating from the internet, unsafe locations, and Outlook attachments through Group Policy.
Deliver end-user guidance to avoid opening unexpected Office attachments and to report suspicious files to the security team.

bash

# Configuration example: Enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f