CVE-2026-83951: Microsoft 365 Apps Information Disclosure

CVE-2026-83951 Overview

CVE-2026-83951 is a buffer over-read vulnerability [CWE-126] in Microsoft Office Word that allows a local attacker to disclose sensitive information. The flaw affects multiple Office product lines, including Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Word 2016. Exploitation requires the target user to open a crafted document. Successful exploitation exposes memory contents that may include sensitive data such as heap pointers, tokens, or document fragments.

Critical Impact
An unauthorized attacker can read out-of-bounds memory in Microsoft Word by inducing a user to open a malicious document, resulting in local information disclosure.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (x86 and x64)
Microsoft Word 2016 (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-83951 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-83951

Vulnerability Analysis

The vulnerability is a buffer over-read within Microsoft Office Word's document parsing logic. When Word processes a specially crafted file, it reads beyond the allocated boundary of an internal buffer. The over-read exposes adjacent memory contents to the parser, which can then leak into rendered output, temporary structures, or error handling paths.

Information disclosure vulnerabilities of this class often reveal heap layout details, pointer values, or residual data from previously freed allocations. Attackers can combine such leaks with separate memory corruption issues to defeat Address Space Layout Randomization (ASLR) or extract confidential document content from process memory.

Exploitation requires user interaction. The victim must open the malicious document in a vulnerable version of Word for the over-read to occur.

Root Cause

The root cause is classified under [CWE-126] Buffer Over-read. Word's parser trusts a length or offset field from the input document without validating it against the true bounds of the underlying buffer. When the parser copies or inspects bytes based on that unchecked value, it reads past the buffer's end into adjacent memory.

Attack Vector

The attack vector is local and requires user interaction. A threat actor delivers a crafted Word document through common channels such as email attachments, shared drives, or malicious downloads. When the target opens the file, the parser triggers the over-read and the attacker recovers disclosed data through the document's rendered content or a chained secondary payload.

No verified public proof-of-concept exists for CVE-2026-83951 at the time of publication. Refer to the Microsoft Security Update for CVE-2026-83951 for authoritative technical details.

Detection Methods for CVE-2026-83951

Indicators of Compromise

Unexpected Word process crashes or Windows Error Reporting entries referencing winword.exe after a user opens an external document.
Word documents delivered from untrusted senders that contain unusual embedded objects, malformed structures, or oversized field descriptors.
Outbound network connections from winword.exe shortly after document open, which may indicate a chained exfiltration payload.

Detection Strategies

Inspect email gateways and file-sharing platforms for .doc, .docx, .rtf, and related Word formats with structural anomalies.
Correlate Office telemetry with endpoint process events to identify Word instances that spawn scripting hosts or unusual child processes after opening a document.
Hunt for repeated Word crashes across multiple hosts, which can indicate a spraying campaign targeting the parser.

Monitoring Recommendations

Enable Microsoft Office diagnostic logging and forward events to a central SIEM for correlation.
Monitor Protected View bypass attempts and macro execution events on hosts running affected Office versions.
Track patch compliance for Microsoft 365 Apps, Office 2019, 2021 LTSC, 2024 LTSC, and Word 2016 across the fleet.

How to Mitigate CVE-2026-83951

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-83951 to all affected Office installations.
Verify that Microsoft 365 Apps clients are on a supported update channel and are pulling the latest build.
Reinforce user awareness guidance covering unsolicited document attachments and external file sources.

Patch Information

Microsoft has released updates addressing CVE-2026-83951 across Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Word 2016. Consult the Microsoft Security Update for CVE-2026-83951 for the specific build numbers and deployment guidance corresponding to each product and architecture.

Workarounds

Keep Protected View enabled for documents originating from the internet and other untrusted locations.
Block or quarantine Word documents received from external senders at the email gateway until patching is complete.
Restrict opening of legacy Word formats using Office File Block policies where operationally feasible.

bash

# Example: verify Microsoft 365 Apps build via Office Deployment Tool
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user