CVE-2026-69626: Microsoft 365 Apps Information Disclosure

CVE-2026-69626 Overview

CVE-2026-69626 is a buffer over-read vulnerability in Microsoft Office that permits an unauthorized attacker to disclose sensitive information over a network. The flaw is tracked under CWE-126: Buffer Over-read and affects multiple supported Office builds across Windows and macOS. Exploitation requires the target to open a crafted document, but no authentication is needed. A successful attack can expose in-process memory contents, including data adjacent to the parsed structure such as heap metadata, pointers, or document fragments.

Critical Impact
An attacker who convinces a user to open a malicious Office file can read out-of-bounds memory and exfiltrate confidential data to a network-controlled destination.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows x64/x86 and macOS)

Discovery Timeline

2026-09-08 - CVE-2026-69626 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-69626

Vulnerability Analysis

The vulnerability is a buffer over-read [CWE-126] in Microsoft Office's document parsing logic. The parser reads past the intended end of a buffer while processing attacker-controlled fields inside an Office file. The over-read exposes adjacent process memory to the attacker rather than corrupting it, which is why the impact is scoped to confidentiality only. Because the affected code paths execute during normal file rendering, the vulnerability can be triggered without any macro execution or additional privilege on the target host.

Root Cause

The defect stems from missing or insufficient length validation when Office consumes a variable-sized field in a document structure. When the declared length exceeds the actual allocation, the parser continues reading beyond the buffer boundary and returns that data into a code path that later transmits or renders it. The behavior is characteristic of CWE-126, where a sentinel or size field is trusted without bounds enforcement.

Attack Vector

Exploitation is network-based but requires user interaction: an attacker delivers a crafted Office document through email, a shared link, or a web download. When the victim opens the file in an affected Office version, the parser processes the malformed structure and leaks memory contents. In targeted scenarios, the disclosed data can include pointers useful for bypassing address space layout randomization (ASLR) in a follow-on exploit chain. See the Microsoft Security Update Guide for the vendor's technical description.

No public proof-of-concept or exploit code is available at the time of publication, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-69626

Indicators of Compromise

Office processes such as WINWORD.EXE, EXCEL.EXE, or POWERPNT.EXE initiating outbound network connections shortly after opening a document from an untrusted source.
Office documents delivered through email or web downloads that contain malformed or oversized embedded structures, particularly from unfamiliar senders.
Crash telemetry or Windows Error Reporting entries referencing Office parsing modules following a document open event.

Detection Strategies

Hunt for Office child processes spawning network utilities or making DNS requests to newly registered or low-reputation domains immediately after file open events.
Correlate email gateway telemetry with endpoint file-open events to flag documents that trigger unusual memory access patterns or outbound HTTP/HTTPS traffic.
Apply YARA rules against inbound Office attachments to identify malformed length fields in Office Open XML and legacy binary formats.

Monitoring Recommendations

Monitor Microsoft Defender and endpoint detection and response (EDR) telemetry for Office parser exceptions and heap read violations.
Track patch compliance across all affected Office SKUs, including macOS builds, using configuration management inventory.
Log and review documents opened from Internet Zone or Mark-of-the-Web (MOTW) sources, and alert on subsequent outbound connections from Office processes.

How to Mitigate CVE-2026-69626

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Office installations.
Prioritize patching endpoints that handle documents from external senders, such as executive assistants, finance, HR, and legal teams.
Verify update deployment on macOS Office builds, which are frequently missed by Windows-focused patch cycles.

Patch Information

Microsoft has published the fix through the standard Office update channels. Refer to the Microsoft Security Update Guide entry for CVE-2026-69626 for build numbers per channel (Current Channel, Monthly Enterprise Channel, Semi-Annual Enterprise Channel) and for LTSC 2016, 2019, 2021, and 2024 packages.

Workarounds

Enable Protected View for files originating from the internet and other untrusted locations, and restrict users from disabling it.
Enforce Office file block policies to prevent opening of legacy binary formats from untrusted sources until patches are applied.
Use email gateway sandboxing and Attack Surface Reduction (ASR) rules to block Office applications from creating child processes or making outbound connections.

bash

# Enforce Protected View for files from the internet via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f