CVE-2026-70318 Overview
CVE-2026-70318 is an improper input validation vulnerability [CWE-20] in Microsoft Office that allows an unauthorized attacker to disclose information locally. The flaw affects multiple Microsoft Office products, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Word 2016. Exploitation requires user interaction, such as opening a specially crafted Office document. Successful exploitation leads to disclosure of sensitive information from the memory or context of the Office process. Microsoft published guidance through the Microsoft Security Response Center.
Critical Impact
A local attacker who convinces a user to open a crafted Office file can read confidential information processed by Microsoft Office applications.
Affected Products
- Microsoft 365 Apps (Enterprise x64/x86) and Microsoft 365 for macOS
- Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
- Microsoft Word 2016 (x64/x86)
Discovery Timeline
- 2026-08-11 - CVE-2026-70318 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-70318
Vulnerability Analysis
The vulnerability stems from improper input validation when Microsoft Office parses structured document content. When Office fails to validate specific fields inside a crafted file, the application processes untrusted data as trusted, exposing adjacent memory or file content in the rendered output. An attacker crafts a malicious document and delivers it through phishing, file shares, or removable media. When the victim opens the file, Office reveals information the attacker would not otherwise possess.
The scope is limited to confidentiality; integrity and availability are not directly impacted. The attack is local and requires user interaction, which reduces the likelihood of mass exploitation but remains relevant for targeted campaigns against high-value users. According to EPSS data from 2026-08-13, the probability of exploitation is 0.36% (28.9 percentile), indicating limited observed exploit interest at publication.
Root Cause
The root cause is missing or insufficient validation of input fields inside Office file formats. Office trusts attacker-controlled length or offset values, causing the parser to read data outside intended boundaries and surface it to the attacker.
Attack Vector
The attacker crafts a malicious Office document and delivers it to the victim. When the user opens the document, Office parses the malformed structure and discloses data from process memory or referenced files. No elevated privileges are required, but the user must interact with the file.
// No public proof-of-concept is available for CVE-2026-70318.
// Refer to the Microsoft Security Response Center advisory for technical details.
Detection Methods for CVE-2026-70318
Indicators of Compromise
- Unexpected Office documents (.xlsx, .docx, .doc, .xls) delivered by email or downloaded from untrusted web sources.
- Office processes (excel.exe, winword.exe) spawning unusual child processes or reading unexpected files after opening a document.
- Outbound network connections initiated from Office processes shortly after a document is opened.
Detection Strategies
- Inspect email gateways and web proxies for Office attachments arriving from external senders with mismatched metadata or macros.
- Correlate endpoint telemetry to identify Office processes performing anomalous file reads or memory access patterns after document open events.
- Apply YARA and static analysis rules that flag malformed Office file structures inconsistent with the Open XML specification.
Monitoring Recommendations
- Monitor Office application crash reports and Windows Error Reporting entries for repeated parsing failures.
- Track document open events with associated user, hostname, and file origin metadata for post-incident review.
- Alert on Office processes accessing sensitive file paths, credential stores, or issuing DNS lookups for untrusted domains.
How to Mitigate CVE-2026-70318
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-70318 advisory to all affected Office installations.
- Inventory endpoints running Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Word 2016 to confirm patch coverage.
- Restrict opening of Office attachments from untrusted senders through email filtering and attachment sandboxing.
Patch Information
Microsoft published patch guidance and update packages through the Microsoft Security Response Center. Administrators should deploy the latest cumulative updates for Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Word 2016 on both Windows and macOS platforms. Update deployment can be managed through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or Microsoft Configuration Manager.
Workarounds
- Enable Protected View for files originating from the internet and other untrusted locations.
- Configure Office File Block policy to prevent opening of legacy or unnecessary file formats.
- Use Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and injecting code.
# Enable Protected View policies via Group Policy registry keys (example for Excel)
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
