CVE-2026-80079: Microsoft 365 Apps Information Disclosure

CVE-2026-80079 Overview

CVE-2026-80079 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Word that allows an unauthenticated attacker to disclose information over a network. An attacker crafts a malicious Word document and delivers it through phishing, file sharing, or a compromised website. When the target opens the document, Word reads memory beyond an allocated buffer and returns process memory contents to the attacker. The flaw affects multiple supported Office builds, including Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Word 2016. Microsoft published the advisory on 2026-09-08.

Critical Impact
A single crafted Word file, once opened by a user, can leak sensitive in-process memory across every supported Office release, giving attackers footholds for follow-on exploitation.

Affected Products

Microsoft 365 Apps (x86 and x64 Enterprise)
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC
Microsoft Word 2016

Discovery Timeline

2026-09-08 - CVE-2026-80079 published to the National Vulnerability Database
2026-09-08 - Microsoft releases security update guidance via Microsoft CVE-2026-80079 Update Guide
2026-09-08 - Last updated in NVD database on 2026-09-08

Technical Details for CVE-2026-80079

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the document parsing logic of Microsoft Word. When Word processes a malformed structure inside a Word document, it reads beyond the boundary of an allocated buffer. The returned bytes can include heap contents such as pointers, document fragments, or other in-process data. Because Word is a client application handling untrusted files daily, this class of flaw is attractive for reconnaissance and to defeat address space layout randomization (ASLR) before pairing with a memory corruption bug.

Root Cause

The root cause is missing bounds validation in a parser that consumes attacker-controlled length or offset fields inside a Word document. Word trusts a size value in the file structure and reads that many bytes from an internal buffer without confirming the read stays within allocation limits. Classified as [CWE-125] Out-of-Bounds Read, the defect exposes adjacent heap memory to the attacker through document content or macro-accessible fields.

Attack Vector

Exploitation requires user interaction. An attacker sends a specially crafted .doc or .docx file through email, chat, a shared drive, or a hosted download. When the user opens the file in a vulnerable Office build, Word performs the out-of-bounds read during parsing. The leaked memory can then be exfiltrated by embedded content, template callbacks, or subsequent attacker-controlled requests. Preview Pane rendering may also trigger the parser depending on configuration.

No public proof-of-concept or exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

// No verified proof-of-concept is publicly available for CVE-2026-80079.
// Refer to the Microsoft Security Response Center advisory for technical details.

Detection Methods for CVE-2026-80079

Indicators of Compromise

Word documents with malformed OLE, RTF, or Office Open XML structures that trigger parser exceptions or crashes in winword.exe.
Outbound network callbacks from winword.exe to unfamiliar domains shortly after a document is opened, especially to raw IP addresses.
Temporary files or embedded templates that reference remote resources over HTTP, WebDAV, or SMB.

Detection Strategies

Hunt for winword.exe spawning unexpected child processes such as powershell.exe, cmd.exe, mshta.exe, or rundll32.exe.
Alert on winword.exe initiating network connections to non-Microsoft destinations immediately after a document open event.
Use YARA rules that flag Word documents containing oversized or negative length fields in embedded objects.

Monitoring Recommendations

Enable Microsoft Office telemetry and forward winword.exe crash and Watson reports to a central SIEM for correlation.
Monitor email gateway logs for inbound .doc, .docx, and .rtf attachments from external senders and detonate high-risk samples in a sandbox.
Track process memory anomalies and access-violation events on endpoints running Office builds listed in the affected products.

How to Mitigate CVE-2026-80079

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-80079 Update Guide to all affected Office installations.
Prioritize patching for users who routinely handle documents from external sources, including finance, HR, legal, and executive assistants.
Verify update deployment status through Microsoft Intune, Configuration Manager, or your patch management platform.

Patch Information

Microsoft has issued updates for Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Word 2016 through the standard Office update channels. Consult the Microsoft CVE-2026-80079 Update Guide for the specific build numbers required on each channel. Confirm that click-to-run installations have received the latest servicing update before closing remediation tickets.

Workarounds

Disable the Outlook Preview Pane and Windows Explorer preview handlers for Word documents until patches are applied.
Enforce Protected View for files originating from the internet, Outlook attachments, and unsafe locations through Group Policy.
Use Attack Surface Reduction rules to block Office applications from creating child processes and from making outbound network calls where feasible.

bash

# Enforce Protected View for high-risk document sources via registry
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f