CVE-2026-70315: Microsoft Office Information Disclosure

CVE-2026-70315 Overview

CVE-2026-70315 is an out-of-bounds read vulnerability in Microsoft Office that allows a local attacker to disclose sensitive information. The flaw is classified under [CWE-125] and requires user interaction to trigger. An attacker convinces a user to open a crafted Office document, causing the application to read memory outside allocated buffer boundaries. Successful exploitation exposes process memory contents, which may include sensitive data or information useful for chaining into further attacks.

Critical Impact
Local information disclosure through crafted Office documents. Exploitation requires user interaction but no authentication, and can leak sensitive in-process memory contents.

Affected Products

Microsoft Office (see the Microsoft Security Update Advisory for specific versions and builds)

Discovery Timeline

2026-08-11 - CVE-2026-70315 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-70315

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Microsoft Office parsing logic. When Office processes a specially crafted document, the application reads memory past the intended buffer boundary. This exposes adjacent memory contents to the attacker-controlled document processing flow.

The attack vector is local and requires user interaction. An attacker must deliver the malicious document through email, a shared file, or a download, and the target user must open it in Office. No privileges are required on the target system prior to exploitation.

The EPSS score is 0.477% with a percentile of 38.98, reflecting a lower observed likelihood of exploitation in the near term. However, information disclosure flaws in Office are commonly paired with memory corruption bugs to bypass Address Space Layout Randomization (ASLR).

Root Cause

The root cause is missing or incorrect bounds validation during document parsing. Office reads structured data from the document without confirming that the read offset stays within the allocated buffer. The result is disclosure of process memory contents into a location an attacker can observe.

Attack Vector

Exploitation requires the attacker to craft a malicious Office document with manipulated structures that trigger the out-of-bounds read. The attacker delivers this document to the victim through phishing or file-sharing channels. Upon opening in a vulnerable Office version, the leaked memory contents may be exfiltrated through embedded content, macros, or observed side effects. Refer to the Microsoft Security Update Advisory for parser-level technical detail.

Detection Methods for CVE-2026-70315

Indicators of Compromise

Office documents from untrusted senders containing malformed or non-standard object structures, embedded OLE content, or unusual XML payloads.
Unexpected Office process crashes or hangs correlated with opening specific documents.
Outbound network connections initiated by winword.exe, excel.exe, or powerpnt.exe shortly after opening an attachment.

Detection Strategies

Monitor Office application child processes and anomalous file reads from user profile directories directly after document open events.
Inspect email gateways and file-sharing platforms for Office documents flagged as malformed by parsers or antivirus heuristics.
Alert on Office processes accessing sensitive memory regions or spawning script interpreters such as powershell.exe or cmd.exe.

Monitoring Recommendations

Enable audit logging for Office document opens and correlate with endpoint telemetry.
Track Windows Event Logs and application crash reports for exceptions originating in Office parsing modules.
Deploy Attack Surface Reduction (ASR) rules that block Office from creating child processes or injecting into other processes.

How to Mitigate CVE-2026-70315

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Advisory as soon as available for your Office channel.
Enforce Protected View for documents originating from the internet or email attachments.
Train users to avoid opening unexpected Office attachments and to report suspicious documents.

Patch Information

Microsoft has published guidance and update packages through the Microsoft Security Response Center. Consult the Microsoft Security Update Advisory to identify the correct patch for the affected Office channel and version installed in your environment.

Workarounds

Block or quarantine Office documents from untrusted external senders at the email gateway until patches are deployed.
Enable Microsoft Defender Attack Surface Reduction rules to restrict Office child process creation and executable content from email.
Configure Office to open files from the internet in Protected View and disable macros from untrusted sources through Group Policy.

bash

# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f