CVE-2026-77911: Microsoft Office Word Information Disclosure Vulnerability
Microsoft Office Word Information Disclosure Vulnerability
Other sources
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.5569.1002Patch KB5002923 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.20960
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker would need to persuade a user to interact with malicious content. The issue can be exploited over a network and does not require the attacker to have prior privileges.
What is the likely impact if exploitation succeeds?
Successful exploitation could expose confidential information. The available data does not indicate an integrity or availability impact.
Which Word deployments should be reviewed?
Review deployments of Word 2016, Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office 2019 32-bit, and the listed Office LTSC 2021 and 2024 editions for Windows and Mac. The provided data does not identify affected build numbers or configuration-specific conditions.