CVE-2026-72976: Microsoft 365 Apps Information Disclosure

CVE-2026-72976 Overview

CVE-2026-72976 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Word. An authorized local attacker can exploit the flaw to disclose information from memory that should not be accessible. Exploitation requires user interaction, typically by opening a crafted Word document. Microsoft has published guidance through its Security Update Guide and provides patches for affected products.

The issue affects multiple Microsoft Office builds across Windows and macOS, including Microsoft 365 Apps, Office LTSC 2021, Office LTSC 2024, Office 2019, and Word 2016. Successful exploitation results in confidentiality impact only; integrity and availability are not affected.

Critical Impact
A local authorized attacker can trigger an out-of-bounds read in Microsoft Word and disclose sensitive process memory contents by convincing a user to open a malicious document.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
Microsoft Office LTSC 2021 and Office LTSC 2024 (x64, x86, and macOS)
Microsoft Office 2019 and Microsoft Word 2016 (x64 and x86)

Discovery Timeline

2026-09-08 - CVE-2026-72976 published to the National Vulnerability Database
2026-09-08 - Last updated in the NVD database

Technical Details for CVE-2026-72976

Vulnerability Analysis

The vulnerability is an out-of-bounds read within Microsoft Office Word. The parser reads memory beyond the bounds of an allocated buffer while processing a specially crafted document. The excess bytes are then reachable by the attacker through document structures or rendered output, resulting in the disclosure of adjacent process memory.

The access vector is local and requires an authenticated user with low privileges to open the file. Exploitation is confined to the local scope, meaning it cannot pivot to other components in the same execution session. Only confidentiality is impacted; the flaw does not enable code execution, tampering, or denial of service on its own.

Exposed memory may contain document content, cached credentials, session material, or pointers useful for defeating Address Space Layout Randomization (ASLR) in subsequent exploitation chains.

Root Cause

The root cause is missing or insufficient bounds checking during the parsing of a Word document structure. When Word processes malformed length fields, record sizes, or offsets, it reads past the end of an allocated buffer. This behavior is classified under [CWE-125] Out-of-bounds Read.

Attack Vector

An attacker crafts a malicious .doc, .docx, or related Office document containing manipulated structural fields. The attacker delivers the file through email, file share, or web download. When an authorized user opens the file in a vulnerable Word build, the parser triggers the out-of-bounds read and the disclosed data is returned to the attacker through document behavior or exfiltration channels embedded in the payload.

No verified proof-of-concept code is publicly available at the time of publication. See the Microsoft Security Update Guide entry for CVE-2026-72976 for vendor technical details.

Detection Methods for CVE-2026-72976

Indicators of Compromise

Unexpected Word process crashes (WINWORD.EXE) or Watson error reports referencing memory access faults during document open operations.
Inbound Office documents with malformed OLE, OOXML, or RTF structures flagged by content inspection engines.
Outbound network connections initiated by WINWORD.EXE shortly after a document is opened, particularly to unfamiliar destinations.

Detection Strategies

Deploy behavioral detection rules that flag Word spawning suspicious child processes or performing unexpected file, registry, or network activity following document open events.
Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and injecting into other processes.
Inspect email attachments and web downloads with a sandbox that detonates Office documents and monitors for parser anomalies and read violations.

Monitoring Recommendations

Collect and centralize Windows event logs, Sysmon, and EDR telemetry from endpoints where Office is installed, focusing on WINWORD.EXE process creation, module loads, and file access.
Alert on Word processes reading unusual memory regions or terminating abnormally shortly after document opens.
Track patch compliance across Microsoft 365 Apps, Office LTSC, Office 2019, and Word 2016 fleets and prioritize hosts that handle untrusted documents.

How to Mitigate CVE-2026-72976

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Guide for CVE-2026-72976 to all affected Office installations.
Prioritize patching endpoints used by roles that regularly open externally sourced documents, such as finance, legal, HR, and executive assistants.
Verify Microsoft 365 Apps update channels are current and confirm managed macOS Office deployments receive the update through Microsoft AutoUpdate.

Patch Information

Microsoft has released fixes through its standard update channels for Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021, Office LTSC 2024, Office 2019, and Word 2016. Consult the Microsoft Security Update Guide entry for the specific build numbers and Knowledge Base articles that address CVE-2026-72976.

Workarounds

Open untrusted Office documents in Protected View and keep Office Protected View settings enforced through Group Policy.
Block or quarantine Office documents from external senders at the email gateway and require conversion to safer formats for high-risk workflows.
Enable Microsoft Defender Attack Surface Reduction rules and Application Guard for Office on hosts that regularly handle untrusted files.

bash

# Example: enforce Protected View for files originating from the Internet via Group Policy registry key
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f