CVE-2026-70206: Microsoft 365 Apps Information Disclosure

CVE-2026-70206 Overview

CVE-2026-70206 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Word. The flaw allows an unauthorized attacker to disclose information over a network when a user opens a specially crafted document. Exploitation requires user interaction but no prior authentication. Successful attacks expose data from adjacent memory regions, potentially including sensitive content, memory layout details, or data useful for chaining with other vulnerabilities.

The vulnerability affects supported Microsoft 365 Apps and Office LTSC releases on both Windows and macOS platforms. Microsoft has published guidance and a security update through the Microsoft Security Response Center (MSRC).

Critical Impact
Attackers can read uninitialized or adjacent process memory from Microsoft Office Word, enabling disclosure of sensitive document content and potentially aiding further exploitation.

Affected Products

Microsoft 365 Apps for Enterprise (x64 and x86)
Microsoft Office LTSC 2021 and Office LTSC 2024 (Windows and macOS)
Microsoft 365 for macOS

Discovery Timeline

2026-10-13 - CVE-2026-70206 published to the National Vulnerability Database (NVD)
2026-10-14 - CVE record last modified in NVD

Technical Details for CVE-2026-70206

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in Microsoft Office Word's document parsing logic. When Word processes a crafted file, it reads beyond the allocated bounds of an in-memory buffer. The resulting data can be returned to the attacker-controlled document rendering path, where it may be observed through document fields, embedded objects, or error output.

The attack reaches the vulnerable code path over the network through standard document delivery vectors such as email attachments, instant messaging, or web downloads. The attacker does not need credentials on the target system. User interaction is required because the victim must open the malicious document in Word.

The confidentiality impact is high while integrity and availability are unaffected. This profile matches a pure information disclosure primitive useful on its own or combined with memory corruption flaws to bypass Address Space Layout Randomization (ASLR).

Root Cause

The root cause is missing or insufficient bounds validation when Word parses a specific structure within a Word document. The parser calculates an index or length derived from attacker-supplied fields and dereferences memory without confirming the computed offset remains inside the allocated buffer. Microsoft has not published low-level technical details. Refer to the Microsoft Security Update CVE-2026-70206 advisory for vendor guidance.

Attack Vector

An attacker crafts a malicious .doc, .docx, or .rtf file containing manipulated structures that trigger the out-of-bounds read. The attacker delivers the file to a target through email, a shared drive, a cloud link, or a web download. When the user opens the document in a vulnerable version of Word, the parser reads memory outside the intended buffer. The leaked bytes can be exfiltrated through rendered output, remote template references, or secondary content fetched by the document.

Detection Methods for CVE-2026-70206

Indicators of Compromise

Microsoft Word processes (WINWORD.EXE) opening documents from untrusted sources immediately followed by outbound network connections to attacker infrastructure.
Word documents containing malformed or anomalous OLE, OOXML, or RTF structures flagged by document inspection tools.
Unexpected child processes, template fetches, or external image loads initiated by Word after opening an email attachment.

Detection Strategies

Monitor endpoint telemetry for Word opening files from Outlook temporary directories, browser download folders, or messaging client caches followed by anomalous network activity.
Deploy mail-gateway and sandbox analysis to detonate inbound Office documents and flag those triggering memory access violations or non-standard parser behavior.
Correlate Office telemetry with egress logs to identify documents that fetch remote resources shortly after opening.

Monitoring Recommendations

Enable Microsoft Office cloud policy and audit logs for document open events, including Protected View bypasses and macro executions.
Alert on Word processes making outbound HTTP, HTTPS, or SMB connections to uncategorized or newly registered domains.
Track crash and Watson telemetry for WINWORD.EXE exceptions related to access violations in document parsing modules.

How to Mitigate CVE-2026-70206

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-70206 advisory across all affected Microsoft 365 Apps and Office LTSC installations.
Enforce Protected View and Office Protected Mode for documents originating from the internet, email, or untrusted file shares.
Block or quarantine inbound Office attachments from external senders at the mail gateway pending patch deployment.

Patch Information

Microsoft has released updates addressing CVE-2026-70206 for Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021, and Office LTSC 2024. Confirm Click-to-Run update channels are current and verify LTSC installations receive the applicable monthly security update. Full remediation details are available on the Microsoft Security Response Center advisory page.

Workarounds

Configure Office File Block policy to prevent opening legacy Word binary formats from untrusted locations until patches are applied.
Require Protected View without the option to enable editing for documents from the internet, Outlook attachments, and unsafe locations.
Restrict Word's ability to load remote templates, images, and linked content through Group Policy to limit data exfiltration paths.

bash

# Example Group Policy registry settings to enforce Protected View for Word
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f