CVE-2026-69739: Microsoft 365 Apps Information Disclosure

CVE-2026-69739 Overview

CVE-2026-69739 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office that allows an unauthorized attacker to disclose information over a network. The flaw affects multiple supported Office releases, including Microsoft 365 Apps and Office 2016 through 2024. Successful exploitation exposes memory contents from the Office process, which can include document data, tokens, or other sensitive material processed by the application. Microsoft published the advisory on September 8, 2026, and the vulnerability carries a network attack vector with no privileges or user interaction required to reach the vulnerable code path.

Critical Impact
An unauthenticated network attacker can read out-of-bounds memory from Microsoft Office, leading to disclosure of sensitive information across all currently supported Office versions.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2016 and Microsoft Office 2019 (x86 and x64)
Microsoft Office LTSC 2021 and Microsoft Office LTSC 2024 (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-69739 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-69739

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Microsoft Office parsing logic. When Office processes a crafted document, the affected code reads beyond the bounds of an allocated buffer. The adjacent memory is returned to attacker-controlled processing paths, enabling disclosure of process memory over a network delivery channel. The issue does not corrupt memory or grant code execution on its own; the impact is confined to confidentiality of data resident in the Office process address space. Disclosed memory can include remnants of previously opened documents, authentication artifacts, or heap metadata useful for chaining with other vulnerabilities.

Root Cause

The root cause is missing or insufficient bounds validation when Office reads structured data from a document. The parser trusts a size or offset value derived from the file, then reads past the end of the intended buffer. This class of bug is tracked as [CWE-125] Out-of-bounds Read and typically results from arithmetic on untrusted length fields or missing checks against allocation boundaries.

Attack Vector

Exploitation occurs over the network through delivery of a malicious Office document. Common vectors include email attachments, links to hosted documents, and files served from compromised web resources or SMB shares. Because the CVSS vector indicates no user interaction is required in the modeled scenario, preview handlers and automatic document processing pipelines are relevant paths of exposure. No public proof-of-concept or exploit code is currently listed for this CVE.

No verified exploit code is available. Refer to the Microsoft CVE-2026-69739 Advisory for authoritative technical details.

Detection Methods for CVE-2026-69739

Indicators of Compromise

Inbound Office documents (.docx, .xlsx, .pptx, .rtf, and legacy binary formats) with malformed structural records or oversized length fields.
Office processes (winword.exe, excel.exe, powerpoint.exe) generating unexpected outbound network traffic shortly after opening a document.
Crash dumps or Windows Error Reporting (WER) events referencing access violations in Office parsing modules.

Detection Strategies

Inspect mail and web gateways for Office documents originating from untrusted senders and quarantine files that fail structural validation.
Correlate Office process telemetry with network egress to identify document-triggered data exfiltration attempts.
Hunt for anomalous child-process and file-read behavior from Office applications following the receipt of external documents.

Monitoring Recommendations

Enable Microsoft Defender attack surface reduction (ASR) rules that log Office child-process creation and Office communication with untrusted hosts.
Forward Office application logs, Sysmon events, and endpoint telemetry to a central SIEM for correlation with mail and proxy logs.
Track patch state across all Office SKUs listed in the affected products section to identify unpatched hosts.

How to Mitigate CVE-2026-69739

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-69739 Advisory to all affected Office installations.
Prioritize patching for endpoints that regularly process externally sourced documents, including mail servers, gateways, and knowledge worker laptops.
Verify Microsoft 365 Apps update channels are current and that LTSC deployments receive the September 2026 security rollup.

Patch Information

Microsoft has released updates for Microsoft 365 Apps and Office 2016, 2019, 2021 LTSC, and 2024 LTSC. Consult the Microsoft CVE-2026-69739 Advisory for the specific build numbers per SKU and architecture. Administrators using Click-to-Run should confirm the target version has been deployed across managed devices.

Workarounds

Enable Protected View and Office Application Guard for documents originating from the internet and other untrusted locations.
Disable the Windows Explorer preview pane for Office file types to reduce automatic parsing of untrusted documents.
Block Office documents at the mail gateway from external senders when business processes allow, or route them through sandbox detonation before delivery.

bash

# Disable Windows Explorer preview handlers for Office file types
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\PreviewHandlers" /v "{84F66100-FF7C-4fb4-B0C0-02CD7FB668FE}" /t REG_SZ /d "" /f

# Force Protected View for files from the internet and unsafe locations (Word example)
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v "DisableInternetFilesInPV" /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v "DisableUnsafeLocationsInPV" /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v "DisableAttachmentsInPV" /t REG_DWORD /d 0 /f