PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64917 Microsoft CVE debrief

Microsoft Office Word Information Disclosure Vulnerability allows an unauthorized attacker to disclose information locally due to an out-of-bounds read issue. This vulnerability affects Microsoft Office Word installations, which defenders should assess for exposure and apply patches to mitigate the risk. The vulnerability has a medium severity and requires verification of information disclosure risk. Defenders should review the official CVE record and NVD entry for details on the vulnerability and apply patches from Microsoft.

Vendor
Microsoft
Product
Microsoft 365 Apps for Enterprise
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-11
Original CVE updated
2026-10-08
Advisory published
2026-08-11
Advisory updated
2026-10-08

Who should care

Defenders responsible for Microsoft Office Word installations should assess exposure and apply patches. They should also verify information disclosure risk and review compensating controls for exposed systems while remediation is scheduled and verified. This includes reviewing relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

CVE-2026-64917 is a medium-severity vulnerability in Microsoft Office Word that allows information disclosure. Defenders should assess exposure, apply patches, and verify information disclosure risk.

  • Information disclosure risk requires verification
  • Patch application is necessary to mitigate risk

Technical summary

An out-of-bounds read issue in Microsoft Office Word allows an unauthorized attacker to disclose information locally. This vulnerability affects Microsoft Office Word installations and requires defenders to assess exposure and apply patches. The technical impact is a medium priority for defenders to verify information disclosure risk and review compensating controls for exposed systems.

Defensive priority

Medium priority for defenders to assess exposure and apply patches

Recommended defensive actions

  • Assess exposure of Microsoft Office Word installations
  • Apply patches from Microsoft
  • Verify information disclosure risk

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but limited information is available on exploitation or impact. Defenders should verify information disclosure risk and review compensating controls for exposed systems while remediation is scheduled and verified. The CVE Program record and NIST NVD detail page offer source-provided CVE metadata and official vulnerability assessment.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64917 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64917

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64917 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64917

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Microsoft Office Word Information Disclosure Vulnerability

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/64xxx/CVE-2026-64917.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64917

    Supplemental source - vendor-advisory, patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.