CVE-2026-66809 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office installations, particularly those using Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office 365 for Mac, and other affected versions.

Why it matters

CVE-2026-66809 is a medium-severity vulnerability in Microsoft Office that allows local information disclosure. Defenders should assess exposure, apply patches, and monitor for potential disclosure attempts. The vulnerability requires verification of Microsoft Office installations and patching of affected versions.

• Potential information disclosure due to out-of-bounds read
• Need to verify exposure of Microsoft Office installations
• Requires patching of affected versions
• Limited information available on exploitation or impact

Technical summary

The vulnerability is caused by an out-of-bounds read in the Microsoft Office Graphics Component, allowing an unauthorized attacker to disclose information locally. The vulnerability affects Microsoft Office installations and requires patching of affected versions. Defenders should assess exposure and apply patches from Microsoft for affected versions. The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or impact.

Defensive priority

Medium priority for defenders to assess exposure and apply patches

Recommended defensive actions

• Assess exposure of Microsoft Office installations to CVE-2026-66809
• Apply patches from Microsoft for affected versions
• Verify inventory of Microsoft Office installations
• Monitor for potential information disclosure attempts

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or impact. The vulnerability has a medium severity score of 5.5 and is classified as an information disclosure vulnerability. There is no information available on known exploitation or ransomware campaign use. Defenders should verify inventory of Microsoft Office installations and monitor for potential information disclosure attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.