Microsoft 365 Apps: Out-of-bounds read in Word allows information disclosure
Summary
An out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. The attacker needs a user to open or preview a crafted document, for example one received by email or downloaded from the internet. The CVSS score is 6.5 (medium) with impact on confidentiality only.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 to the build fixed in the October 2026 update (exact threshold not confirmed, see MSRC)
- Office LTSC 2021: 16.0.1 to below 16.0.14334.20974
- Office LTSC 2024: 16.0.0 to below 16.0.17932.21056
Fixed in
- Office LTSC 2021: 16.0.14334.20974 or later (per third-party mirror of the CNA data)
- Office LTSC 2024: 16.0.17932.21056 or later (per third-party mirror of the CNA data)
- Microsoft 365 Apps: October 13, 2026 update; exact builds could not be confirmed and differ between sources, so check the MSRC table
Workaround
Unknown. No vendor workaround was found for this CVE.
- Interim measure (general recommendation, not from a vendor source): keep Protected View enabled for internet and email attachments and restrict macros and untrusted file types.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof-of-concept found (not exhaustively searched).
- CISA SSVC: Exploitation none, not automatable, partial technical impact.
Our recommendation
- Install the October 2026 Office security update on all Microsoft 365 Apps and Office LTSC systems as part of the normal patch cycle.
- Before rollout, verify the exact fixed builds in the MSRC Security Update Guide.
- Keep Protected View enabled and handle documents from email and downloads with caution.
- Monitor for exploitation reports for this CVE.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-102867 msrc.microsoft.com
- Microsoft 365 Apps security updates learn.microsoft.com
- Strix.ai: CVE-2026-102867 www.strix.ai
- Qualys: Microsoft Patch Tuesday October 2026 blog.qualys.com
- VulDB: CVE-2026-102867 vuldb.com
- Vulners (MSCVE): CVE-2026-102867 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 5 Nov 2026, 11:34.
Original description (NVD)
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.