CVE-2026-77173: Medium severity vulnerability
Published Oct 27, 2026
·Updated
A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.
Event History
Oct 27, 2026
CVE Published
via MITRE·04:15 PM
Data Sourced
via MITRE·04:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attacker needs privileges to create a DOCX or ODT file. No user interaction is required according to the supplied vector.
2
What files are involved?
The issue applies to DOCX and ODT files whose filename includes a # character and that contain confidential information, such as a credit card number.
3
What is the impact if exploitation succeeds?
The file may not be marked as confidential, exposing confidential content to handling or classification workflows that rely on that marking. The provided vector rates confidentiality impact as low and indicates no integrity or availability impact.