CVE-2026-70105: Microsoft Word Information Disclosure Vulnerability
Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Other sources
Microsoft Word Information Disclosure Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.112.26081010 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.5565.1000Patch KB5002901
Event History
Frequently Asked Questions
Which deployments are identified as affected?
The affected software list includes Microsoft 365 Apps for Enterprise, Word 2016, Office LTSC 2021 and 2024 for 32-bit and 64-bit editions, Office 2019 for 64-bit editions, and Office 365 for Mac.
Does exploitation require prior authentication or elevated privileges?
No. The vector specifies no privileges required (PR:N), so an attacker does not need to be authenticated before attempting exploitation.
What user interaction is required?
User interaction is required (UI:R). This indicates exploitation depends on a user taking an action, though the specific action is not provided.
What is the expected security impact?
The stated impact is information disclosure with high confidentiality impact (C:H). No integrity or availability impact is indicated (I:N and A:N).