CVE-2026-83949: Microsoft 365 Apps Information Disclosure

CVE-2026-83949 is an information disclosure vulnerability in Microsoft 365 Apps caused by a buffer over-read in Office Word. Attackers with local access can exploit this flaw to view sensitive data. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-83949 Overview

CVE-2026-83949 is a buffer over-read vulnerability in Microsoft Office Word that enables local information disclosure. An unauthorized attacker can read memory beyond an intended buffer boundary by convincing a user to open a crafted document. The flaw is categorized under [CWE-126: Buffer Over-read] and affects multiple supported Office builds across x86 and x64 architectures. Exploitation requires user interaction but no prior authentication. Successful exploitation exposes sensitive process memory that may include document content, cached credentials, or other in-memory secrets. Microsoft published the advisory on September 8, 2026.

Critical Impact
Local information disclosure through out-of-bounds memory read in Microsoft Word, triggered by opening a malicious document.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024
Microsoft Word 2016

Discovery Timeline

2026-09-08 - CVE-2026-83949 published to NVD
2026-09-08 - Microsoft releases security update guidance
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-83949

Vulnerability Analysis

The vulnerability is a buffer over-read in Microsoft Word's document parsing logic. When Word processes a specially crafted file, the parser reads past the allocated buffer boundary. This out-of-bounds read exposes adjacent process memory to the attacker's document context. The disclosed memory may include content from other open documents, heap-resident secrets, or fragments of previously freed allocations.

The attack requires local delivery of the malicious file and user interaction to open it in Word. No elevated privileges are needed to trigger the condition. The flaw impacts confidentiality only; integrity and availability of the host remain intact.

Root Cause

The root cause is improper validation of a length or offset field during document parsing, classified as [CWE-126]. Word trusts an attacker-controlled size value and reads memory beyond the intended structure, returning uninitialized or unrelated data to the parser's downstream logic.

Attack Vector

Exploitation follows a document-based delivery model. An attacker crafts a malicious .doc, .docx, or related Word file that includes malformed size or offset fields. The file is delivered through phishing email, file share, USB media, or a compromised download. When the victim opens the file in a vulnerable Word build, the parser triggers the over-read and leaks memory contents that the attacker can exfiltrate through the document context, such as through embedded fields or callbacks. See the Microsoft CVE-2026-83949 Update Guide for vendor detail.

Detection Methods for CVE-2026-83949

Indicators of Compromise

Unexpected Word documents arriving from external senders that request macro or content activation on open.
Word processes (WINWORD.EXE) crashing or logging Application Error events shortly after opening a document.
Outbound network connections initiated by WINWORD.EXE immediately after document open, indicating potential exfiltration of leaked memory.

Detection Strategies

Inspect inbound email attachments for malformed Office Open XML structures and abnormal record sizes in binary Word formats.
Alert on WINWORD.EXE spawning unusual child processes or making outbound HTTP/DNS requests to non-corporate destinations.
Correlate Windows Error Reporting events for Word crashes with recently opened documents to identify parser-triggered faults.

Monitoring Recommendations

Enable and forward Microsoft Office telemetry and Windows Application event logs to a centralized SIEM.
Monitor endpoints for Word processes reading memory in patterns consistent with document exploitation attempts.
Track document provenance using Mark-of-the-Web tags to prioritize investigation of files opened from internet or email sources.

How to Mitigate CVE-2026-83949

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-83949 Update Guide across all Office installations.
Prioritize patching endpoints used by high-value personnel such as executives, finance, and IT administrators.
Enforce Protected View for documents originating from the internet, email attachments, and unsafe file locations.

Patch Information

Microsoft has published fixes for Microsoft 365 Apps, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016 through the standard update channels. Administrators should deploy the update via Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or the Office Click-to-Run channel appropriate to the deployment.

Workarounds

Block or quarantine Word documents from untrusted senders at the email gateway until patches are deployed.
Configure Group Policy to force Protected View and disable automatic content activation for files from unsafe origins.
Restrict user permission to open Office documents from removable media and network shares outside trusted domains.

bash

# Configuration example: enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f