CVE-2026-66806 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office Word installations, particularly in local threat scenarios, should assess exposure and apply patches. This includes security teams and vulnerability management teams who need to prioritize patching and verify local information disclosure risk. The vulnerability affects Microsoft Office Word installations, and defenders should review compensating controls for exposed systems.

Why it matters

Defenders should assess exposure of Microsoft Office Word installations and apply patches due to the information disclosure vulnerability.

• Local information disclosure risk
• Potential for unauthorized data access
• Need for patching and verification

Technical summary

An off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally. The vulnerability impacts local threat scenarios, particularly for defenders responsible for Microsoft Office Word installations. The error enables information disclosure, which could lead to unauthorized data access. Defenders should assess exposure and apply patches from Microsoft.

Defensive priority

Medium priority for defenders to assess exposure and apply patches

Recommended defensive actions

• Assess exposure of Microsoft Office Word installations
• Apply patches from Microsoft
• Verify local information disclosure risk

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation or impact is limited. There is no evidence of public exploitation, but defenders should verify local information disclosure risk. The vulnerability affects Microsoft Office Word installations, and defenders should assess exposure and apply patches from Microsoft. The information disclosure risk is medium priority for defenders to address.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.