CVE-2026-78506: Microsoft 365 Apps Information Disclosure

CVE-2026-78506 Overview

CVE-2026-78506 is an information disclosure vulnerability in Microsoft Office Word caused by improper null termination [CWE-170]. An attacker can craft a malicious document that, when opened by a user, exposes memory contents to the attacker locally. The flaw affects multiple Office product lines across Windows and macOS, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Word 2016.

Exploitation requires user interaction, meaning the target must open the crafted file. No privileges are required, and the attack vector is local. The confidentiality impact is rated high, while integrity and availability are unaffected.

Critical Impact
Successful exploitation discloses potentially sensitive memory contents from the Word process to a local attacker who convinces a user to open a crafted document.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, Office 2024 LTSC (Windows and macOS)
Microsoft Word 2016 (x64 and x86)

Discovery Timeline

2026-09-08 - CVE-2026-78506 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-78506

Vulnerability Analysis

The vulnerability originates in how Microsoft Word handles string termination when parsing document content. Improper null termination [CWE-170] causes string-handling routines to read past the intended end of a buffer. As a result, adjacent memory contents can be included in fields the application processes or exposes to the user.

Because the affected data path is triggered during document parsing, a specially crafted .docx or .doc file is sufficient to trigger the condition. The disclosed memory may contain fragments of previously processed documents, cached credentials, tokens, or other application state. The attacker does not need code execution or elevated privileges to obtain the leaked data.

The issue is scoped to the local user context. Confidentiality impact is high because sensitive data resident in the Word process address space can be revealed. Integrity and availability are unaffected by the flaw itself.

Root Cause

The underlying weakness is a failure to properly terminate strings with a null byte during parsing or copy operations. When downstream code treats the buffer as a null-terminated string, it reads until it encounters an unrelated null byte in adjacent memory. This exposes uninitialized or out-of-bounds bytes back through document fields, dialogs, or file output.

Attack Vector

An attacker crafts a malicious Office document containing structures that trigger the improper termination path. The attacker delivers the file through email, shared drives, collaboration platforms, or malicious websites. When the target opens the document, the parsing routine leaks memory contents that the attacker can retrieve, for example by embedding the leaked bytes into visible document fields that are then exfiltrated.

No verified proof-of-concept code is publicly available. Refer to the Microsoft Security Update for CVE-2026-78506 for vendor technical details.

Detection Methods for CVE-2026-78506

Indicators of Compromise

Office documents received from untrusted senders that contain malformed string fields, unusual embedded objects, or abnormal field codes.
WINWORD.EXE opening documents from download or temporary directories immediately followed by outbound network connections to unfamiliar hosts.
Documents that render unexpected binary or non-printable characters within visible content, which may indicate leaked memory being surfaced.

Detection Strategies

Inspect email and web gateway telemetry for Office documents delivered from external senders that contain non-standard OOXML structures.
Correlate WINWORD.EXE process telemetry with subsequent child processes, script interpreters, or network egress that would enable data exfiltration.
Apply YARA rules that flag malformed string tables or truncated null-terminator patterns in Office file archives.

Monitoring Recommendations

Monitor Microsoft Office update posture across the fleet to identify hosts running unpatched builds of Word, Microsoft 365 Apps, and Office LTSC.
Alert on Protected View bypass events, macro enablement on documents from the Internet zone, and Office child-process creation.
Retain document open and DLP telemetry in a centralized data lake to support retrospective hunting once new indicators emerge.

How to Mitigate CVE-2026-78506

Immediate Actions Required

Apply the Microsoft security updates for all affected Office channels as listed in the Microsoft Security Update Guide.
Prioritize patching endpoints that routinely handle documents from external parties, including executive assistants, finance, HR, and legal.
Enforce Protected View and Office Trusted Documents policies for files originating from the Internet and email attachments.

Patch Information

Microsoft has published a security update addressing CVE-2026-78506 for all affected products, including Microsoft 365 Apps (x64 and x86 enterprise builds), Microsoft 365 for macOS, Office 2019, Office 2021 LTSC (Windows and macOS), Office 2024 LTSC (Windows and macOS), and Word 2016. Refer to the Microsoft Security Update for CVE-2026-78506 for build numbers and deployment guidance across Current Channel, Monthly Enterprise Channel, and Semi-Annual channels.

Workarounds

Open untrusted documents only in Protected View and disable editing until the sender and content are validated.
Use Office File Block policies through Group Policy to restrict legacy Word binary formats where feasible.
Route inbound Office documents through a sandboxing or content disarm and reconstruction (CDR) pipeline that normalizes structures before delivery.

bash

# Example Group Policy registry keys to enforce Protected View for files from the Internet and unsafe locations
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f