CVE-2026-80090: Microsoft 365 Apps Information Disclosure

CVE-2026-80090 Overview

CVE-2026-80090 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Word that allows an unauthenticated attacker to disclose information over a network. The flaw affects multiple Microsoft Office and Microsoft 365 product families across Windows and macOS. Exploitation requires user interaction, typically opening a crafted document. Successful exploitation exposes memory contents that may include sensitive data such as heap addresses, pointers, or document fragments useful for further attacks.

Critical Impact
Attackers can trigger an out-of-bounds read in Microsoft Word via a malicious document to disclose confidential process memory over the network, aiding reconnaissance and follow-on exploitation.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (Windows and macOS variants)
Microsoft Word 2016 (x64 and x86)

Discovery Timeline

2026-09-08 - CVE-2026-80090 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-80090

Vulnerability Analysis

The vulnerability is an out-of-bounds read within Microsoft Word's document parsing logic. When Word processes a specially crafted file, the parser reads beyond the allocated buffer boundary and returns memory contents that were never intended to be exposed. The disclosed bytes may contain heap metadata, stack fragments, pointers, or residual document data.

The defect impacts confidentiality only. Integrity and availability of the target system remain unaffected, and no code execution occurs as a direct result. Attackers commonly chain information disclosure flaws with memory corruption vulnerabilities to bypass Address Space Layout Randomization (ASLR) and improve exploit reliability.

Root Cause

The issue is classified under CWE-125: Out-of-bounds Read. It stems from insufficient bounds validation on a length or index field parsed from an untrusted document structure. Word trusts a size value from the file without verifying it against the actual allocated buffer, causing a read past the end of the object.

Attack Vector

The attack vector is network-based but requires user interaction. An attacker crafts a malicious .doc, .docx, or .rtf file and delivers it via phishing email, a compromised website, a shared drive, or a collaboration platform. The victim opens the file in a vulnerable version of Word, triggering the out-of-bounds read. Disclosed memory can be exfiltrated through embedded content, remote template references, or paired with a companion vulnerability to transmit leaked data back to the attacker.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at the time of publication. See the Microsoft CVE-2026-80090 Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-80090

Indicators of Compromise

Microsoft Word documents received from untrusted senders that contain malformed OOXML structures, unusually large or negative length fields, or corrupted embedded objects
Word process (WINWORD.EXE) initiating outbound network connections to unfamiliar domains shortly after opening a document
Documents containing remote template references, external image links, or INCLUDEPICTURE fields that fetch resources from attacker-controlled infrastructure

Detection Strategies

Inspect email attachments and file uploads with sandbox detonation to identify crafted documents that trigger read violations in WINWORD.EXE
Monitor Windows Error Reporting and application crash telemetry for WINWORD.EXE faults referencing access violations during document open
Deploy YARA rules targeting malformed Office Open XML records and RTF control words associated with parser abuse

Monitoring Recommendations

Track outbound HTTP/HTTPS connections originating from Office applications and alert on connections to newly registered or low-reputation domains
Correlate document open events with subsequent child process creation, DNS lookups, and network egress using endpoint detection and response (EDR) telemetry
Log and review Microsoft Defender SmartScreen and Protected View bypass events for Office file types

How to Mitigate CVE-2026-80090

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft CVE-2026-80090 Advisory across all affected Office and Microsoft 365 installations
Verify update deployment status on Windows and macOS endpoints using your patch management tooling
Prioritize patching for users with elevated privileges, executive assistants, and roles that routinely process externally sourced documents

Patch Information

Microsoft has published fixes through its standard update channels for Microsoft 365 Apps, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft 365 for macOS, and Word 2016. Consult the Microsoft Security Response Center advisory for exact build numbers per channel and platform. Click-to-Run installations update automatically; MSI-based deployments require the corresponding security update package.

Workarounds

Enable Protected View for files originating from the internet, email attachments, and unsafe locations to open documents in a restricted sandbox
Configure Office File Block policy to prevent opening legacy binary formats (.doc) from untrusted zones until patches are deployed
Enforce Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from making outbound network calls where feasible
Deliver targeted user awareness reminders about opening unsolicited Word attachments

bash

# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f