CVE-2026-70323 Overview
CVE-2026-70323 is an improper input validation vulnerability in Microsoft Office that allows a local, unauthorized attacker to disclose sensitive information. The flaw is tracked under [CWE-20] (Improper Input Validation) and requires user interaction to trigger. An attacker crafts a malicious Office document and delivers it to a target user. When the user opens the file, Office fails to properly validate embedded input, allowing the attacker to read information they should not access.
Critical Impact
Successful exploitation enables local information disclosure from Microsoft Office through a crafted document, with confidentiality impact rated high while integrity and availability remain unaffected.
Affected Products
- Microsoft Office (see the Microsoft Security Update Guide for specific builds)
Discovery Timeline
- 2026-08-11 - CVE-2026-70323 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-70323
Vulnerability Analysis
The vulnerability stems from improper input validation within Microsoft Office document parsing routines. Office accepts attacker-controlled content inside a document without correctly validating its structure or boundaries. During parsing, the flawed logic reads memory or data outside its intended context and exposes that data back to the attacker's document logic. The result is local disclosure of information the user's process can access. Exploitation requires the victim to open the crafted file, which limits reach but aligns with common phishing and malicious-attachment workflows.
Root Cause
The root cause is a failure to enforce input validation on structured content processed by Microsoft Office. Per [CWE-20], the application does not verify that input conforms to expected format, length, or type before use. This gap allows a specially crafted Office file to steer parsing into a state that leaks data.
Attack Vector
The attack vector is local and requires user interaction. An attacker delivers a crafted Office document through email, file share, or web download. When the user opens the document, Office processes the malicious content and returns disclosed data to attacker-controlled elements inside the file, such as fields, formulas, or external references. No elevated privileges are needed to launch the attack. Microsoft's advisory in the Microsoft Security Update Guide provides authoritative technical details.
No verified public exploit code is available for CVE-2026-70323 at the time of writing.
Detection Methods for CVE-2026-70323
Indicators of Compromise
- Office documents arriving from untrusted senders that include external references, unusual embedded objects, or obfuscated field codes.
- Unexpected outbound network connections initiated by winword.exe, excel.exe, or powerpnt.exe shortly after a document is opened.
- Office processes reading sensitive local files outside the user's normal document workflow.
Detection Strategies
- Hunt for Office applications spawning child processes or accessing credential stores, browser profiles, or SSH keys.
- Correlate email gateway telemetry with endpoint file-open events to identify suspicious document delivery followed by anomalous Office behavior.
- Monitor for Office documents containing external data connections, DDE fields, or references to remote resources.
Monitoring Recommendations
- Enable Microsoft Office telemetry and forward logs to a SIEM for correlation with endpoint and email data.
- Alert on Office processes performing large or unusual read operations against user profile directories.
- Track document provenance using Mark-of-the-Web to distinguish internet-sourced files from trusted internal content.
How to Mitigate CVE-2026-70323
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all systems running affected Microsoft Office versions.
- Prioritize patching for users who routinely open external documents, including finance, HR, and executive assistants.
- Reinforce user awareness training on opening unsolicited Office attachments.
Patch Information
Microsoft has released a security update addressing CVE-2026-70323. Refer to the Microsoft Security Update Guide for the definitive list of affected builds and corresponding patch identifiers. Deploy through Windows Update, Microsoft 365 Apps update channels, or your standard enterprise patch management workflow.
Workarounds
- Enforce Protected View for files originating from the internet and other untrusted locations.
- Block or restrict macros, DDE, and external content in Office via Group Policy until patches are deployed.
- Use Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes or accessing sensitive resources.
# Example Group Policy setting to enforce Protected View for internet-sourced files
# Registry path (per user):
# HKCU\Software\Microsoft\Office\<version>\<app>\Security\ProtectedView
# Value: DisableInternetFilesInPV = 0 (Protected View enabled)
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
