CVE-2026-70263: Microsoft 365 Apps Information Disclosure

CVE-2026-70263 Overview

CVE-2026-70263 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Word. An unauthorized attacker can exploit the flaw to disclose information over a network. The vulnerability affects multiple supported Office editions on Windows and macOS, including Microsoft 365 Apps, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Exploitation requires user interaction, typically the opening of a crafted Word document. Microsoft published the advisory through the Microsoft Security Response Center.

Critical Impact
Successful exploitation discloses sensitive process memory to an attacker through a maliciously crafted Word document, risking exposure of in-memory data such as document contents, pointers, or credentials.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office LTSC 2021 and Microsoft Office LTSC 2024 (Windows x64/x86 and macOS)

Discovery Timeline

2026-10-13 - CVE-2026-70263 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-70263

Vulnerability Analysis

The flaw is an out-of-bounds read in the Word document parser. When Word processes a crafted file, it reads memory beyond the bounds of an allocated buffer. The attacker receives data derived from adjacent memory, enabling information disclosure to a remote party. The impact is limited to confidentiality; integrity and availability are not affected by this issue. Exploitation requires the victim to open or preview a malicious document, so attacks typically pair with phishing or watering-hole delivery.

Root Cause

The root cause is missing or incorrect bounds validation during parsing of a Word file structure. The parser reads a length or offset from attacker-controlled content and uses it without verifying that the resulting read stays within the allocated buffer. This maps to CWE-125 (Out-of-bounds Read). Microsoft has not published the specific internal component or structure impacted beyond the Office Word parser.

Attack Vector

The attack vector is network-based delivery of a crafted .doc, .docx, or related Word file. The adversary emails the file, hosts it on a web page, or shares it through collaboration services. When the user opens the file in Office Word, the parser performs the out-of-bounds read. Leaked bytes can be exfiltrated via document-embedded features that reach back to attacker-controlled infrastructure. No elevated privileges are required for the attacker; the victim operates with standard user rights.

No verified public proof-of-concept is available at this time. See the Microsoft Security Update Guide for CVE-2026-70263 for authoritative details.

Detection Methods for CVE-2026-70263

Indicators of Compromise

Inbound email attachments containing Word documents from untrusted or newly observed senders, especially files with unusual OLE or OOXML structures.
Office Word processes (WINWORD.EXE) initiating outbound network connections to uncommon domains shortly after opening a document.
Office child processes spawning scripting hosts such as powershell.exe, wscript.exe, or mshta.exe following document open events.

Detection Strategies

Hunt for Word processes making outbound HTTP, HTTPS, or SMB connections immediately after a document open event.
Inspect email gateways and web proxies for Word documents containing malformed records that trigger parser anomalies.
Correlate telemetry for crashes or Watson error reports originating from WINWORD.EXE with recent document opens.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office child-process creation and executable content from email.
Forward Office telemetry, Sysmon process and network events, and email gateway logs to a centralized analytics platform for correlation.
Monitor for repeated delivery of similar document samples across multiple recipients, a common pattern in targeted information-disclosure campaigns.

How to Mitigate CVE-2026-70263

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-70263 to all affected Office installations across Windows and macOS.
Prioritize patching for high-value users and systems that routinely process external documents, including executives, finance, HR, and legal.
Enable Protected View and Office Trust Center policies to block macros and active content from documents originating on the internet.

Patch Information

Microsoft has issued fixes through the Microsoft Security Response Center. Refer to the Microsoft Security Update Guide for CVE-2026-70263 for channel-specific build numbers covering Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021, and Office LTSC 2024. Validate that Office update channels (Current, Monthly Enterprise, Semi-Annual) have received the appropriate build and restart Office applications to complete installation.

Workarounds

Enforce Protected View for files originating from the internet, Outlook attachments, and unsafe locations until patches deploy.
Block or quarantine inbound Word attachments at the email gateway for untrusted senders during the patch window.
Disable automatic preview of Word attachments in Outlook to reduce exposure from parser-triggered reads.

bash

# Example Group Policy registry settings to enforce Protected View for Word
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f