CVE-2026-78506 Microsoft CVE debrief

Who should care

Defenders and IT administrators responsible for Microsoft Office Word installations, especially in high-risk local access scenarios, should assess exposure and prioritize patching.

Why it matters

CVE-2026-78506 is a medium-severity vulnerability in Microsoft Office Word that could allow local information disclosure due to improper null termination. Defenders and IT administrators should assess exposure, prioritize patching for high-risk scenarios, and verify local access controls.

• Local information disclosure risk requires assessment and mitigation
• Patching priority for high-risk local access scenarios
• Verification of local system and user access controls to limit potential exploitation

Technical summary

The CVE-2026-78506 vulnerability in Microsoft Office Word is caused by improper null termination, which could allow an unauthorized attacker to disclose information locally. The vulnerability has a CVSS score of 5.5 and is considered medium severity.

Defensive priority

Medium priority for local information disclosure risk assessment and patching

Recommended defensive actions

• Assess exposure of Microsoft Office Word installations to the improper null termination vulnerability
• Prioritize patching for high-risk local access scenarios
• Verify local system and user access controls to limit potential exploitation

Evidence notes

The CVE record and NVD entry provide details on the improper null termination vulnerability in Microsoft Office Word, which could allow local information disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.