CVE-2026-80076 Overview
CVE-2026-80076 is an out-of-bounds read vulnerability [CWE-125] affecting multiple versions of Microsoft Office. An unauthorized attacker can disclose sensitive information over a network by convincing a user to open a specially crafted Office document. The flaw exists in how Office parses document structures, causing the application to read memory beyond an intended buffer boundary. Exploitation requires user interaction but no authentication or elevated privileges. The vulnerability affects Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021 LTSC, and Office 2024 LTSC across Windows and macOS platforms.
Critical Impact
Successful exploitation leaks confidential memory contents from the Office process, potentially exposing document data, credentials, or address space information useful for chaining further attacks.
Affected Products
- Microsoft 365 Apps (Enterprise x64 and x86)
- Microsoft 365 for macOS
- Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Discovery Timeline
- 2026-09-08 - CVE-2026-80076 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-80076
Vulnerability Analysis
The vulnerability is an out-of-bounds read [CWE-125] in Microsoft Office document parsing logic. When Office processes a malformed file, it dereferences a pointer or index that extends past the allocated buffer. The resulting read returns adjacent process memory to attacker-controlled parsing paths. That data can then be exfiltrated through document rendering artifacts, embedded objects, or telemetry channels reachable to the attacker.
Because the flaw affects confidentiality only, it does not enable direct code execution or data modification. Leaked memory can still include sensitive information such as recently opened document contents, session tokens held in the Office process, or heap layout details. Attackers commonly chain information disclosure primitives like this one with memory corruption bugs to bypass Address Space Layout Randomization (ASLR).
Root Cause
The root cause is missing or incorrect bounds validation when Office parses a structured field within a document format. The parser trusts a length or offset value derived from attacker-supplied input and reads memory relative to that value without confirming it falls inside the allocated object. See the Microsoft Security Update CVE-2026-80076 for vendor-supplied technical detail.
Attack Vector
The attack vector is network-based delivery of a crafted Office document. Typical scenarios include phishing emails with a malicious attachment, links to documents hosted on attacker-controlled shares, or files delivered through collaboration platforms. The victim must open the document in a vulnerable Office version for the parser to reach the out-of-bounds read. No prior authentication to the target system is required.
The vulnerability manifests during document parsing, so Protected View and Mark-of-the-Web enforcement can materially reduce exposure. See vendor documentation for parsing paths reachable in preview handlers.
Detection Methods for CVE-2026-80076
Indicators of Compromise
- Unusual Office application crashes or Watson error reports referencing document parsing modules shortly after opening an email attachment.
- Office child processes spawning network connections to previously unseen external hosts.
- Inbound emails carrying Office attachments from unverified senders that trigger antimalware document heuristics.
Detection Strategies
- Correlate email gateway telemetry with endpoint document-open events to surface high-risk delivery patterns.
- Alert on Office processes (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) reading unusual memory regions or generating exception dumps.
- Deploy YARA or content-inspection rules that flag Office documents with malformed length fields or oversized structured storage streams.
Monitoring Recommendations
- Ingest Microsoft Defender, mail gateway, and endpoint telemetry into a centralized data lake for cross-source correlation.
- Monitor for outbound connections from Office processes to non-corporate destinations following document open events.
- Track Office version and build inventory to identify unpatched hosts exposed to CVE-2026-80076.
How to Mitigate CVE-2026-80076
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-80076 to all affected Office installations.
- Prioritize patching for users who routinely open documents from external senders, including finance, legal, and executive staff.
- Verify that Microsoft 365 Apps update channels are enabled and that macOS Office builds receive updates through AutoUpdate.
Patch Information
Microsoft has released fixes through its standard update-guide channel. Refer to the Microsoft Security Update CVE-2026-80076 advisory for the specific build numbers that remediate this issue across Microsoft 365 Apps, Office 2019, Office 2021 LTSC, and Office 2024 LTSC on Windows and macOS.
Workarounds
- Enforce Protected View for documents originating from the internet and other untrusted locations.
- Preserve Mark-of-the-Web on files delivered through email and browsers so Office opens them in a sandboxed context.
- Block or quarantine inbound Office attachments from external senders when business workflows allow, or route them through a sandbox detonation service.
- Disable Office document preview handlers in email clients where the parsing path is reachable without explicit user action.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.