CVE-2026-70319: Microsoft Word Information Disclosure

CVE-2026-70319 Overview

CVE-2026-70319 is an information disclosure vulnerability in Microsoft Office Word caused by improper input validation [CWE-20]. An attacker can craft a malicious document that, when opened by a user, discloses sensitive information from the local system. The flaw requires user interaction and local access, which limits mass exploitation but remains relevant for targeted phishing and document-borne attack scenarios.

Microsoft published the advisory on 2026-08-11. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing has been reported at the time of writing.

Critical Impact
Successful exploitation exposes confidential data from the local user context, providing attackers with reconnaissance material or credentials for follow-on intrusion activity.

Affected Products

Microsoft Office Word (specific versions listed in the Microsoft CVE-2026-70319 Advisory)
Microsoft 365 Apps deployments containing the vulnerable Word component
On-premises Office installations distributed through Microsoft update channels

Discovery Timeline

2026-08-11 - CVE CVE-2026-70319 published to NVD
2026-08-11 - Microsoft security advisory released
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-70319

Vulnerability Analysis

The vulnerability lives in Microsoft Office Word's document parsing logic. Word fails to properly validate input within a crafted document, allowing an attacker to read memory or file content that should remain isolated from the document context. The disclosure is confined to the local machine and the privileges of the user opening the file.

Exploitation requires social engineering. An attacker must convince a target to open a specially crafted Word document, typically via email attachment, shared drive, or download link. The impact is limited to confidentiality; the flaw does not permit code execution, integrity changes, or denial of service. However, disclosed content can include memory addresses, file fragments, or user data useful for chaining with additional vulnerabilities.

Root Cause

The root cause is improper input validation [CWE-20] in a Word document processing routine. Malformed or unexpected structures within the document trigger the parser to read and expose data outside the intended boundary of the document content.

Attack Vector

The attack vector is local with required user interaction. An attacker delivers a weaponized .doc, .docx, or related Word file to the victim. Upon opening, Word processes the malformed input and returns sensitive data that the attacker can exfiltrate through embedded elements or subsequent interaction. See the Microsoft CVE-2026-70319 Advisory for vendor-specific technical detail.

Detection Methods for CVE-2026-70319

Indicators of Compromise

Unexpected Word documents arriving from external senders, especially those with macros, embedded objects, or unusual template references
Word process (WINWORD.EXE) spawning outbound network connections shortly after opening a document
Anomalous file reads by WINWORD.EXE against user profile directories or credential stores

Detection Strategies

Inspect email gateways for Word attachments with malformed OOXML structures or non-standard schema references
Correlate document open events with subsequent network egress or unusual child process creation
Hunt for Word document telemetry that indicates access to files outside typical user working directories

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from making network calls
Log and retain Office telemetry, including Protected View events and document trust decisions
Alert on WINWORD.EXE reading files from sensitive paths such as browser credential stores or SSH key directories

How to Mitigate CVE-2026-70319

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-70319 Advisory across all Office deployments
Enforce Protected View for documents originating from the internet, email, and untrusted locations
Educate users on the risk of opening unsolicited Word attachments, even when the sender appears familiar

Patch Information

Microsoft addressed CVE-2026-70319 in the August 2026 security update cycle. Administrators should confirm patch deployment through Microsoft Update, Microsoft 365 Apps update channels, or their enterprise patch management platform. Verify the installed Office build against the fixed version listed in the Microsoft advisory.

Workarounds

Configure Group Policy to block Office documents from executing macros downloaded from the internet
Restrict Word from opening files sourced from untrusted network shares by tightening File Block Settings in the Trust Center
Use application allowlisting to constrain Word's file access to approved directories where feasible

bash

# Configuration example: enforce Protected View via registry (Word 2016+)
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f