CVE-2026-78522 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office Word and related products should assess exposure and prioritize verification and updates. This includes operators, administrators, and security teams responsible for maintaining and securing Microsoft Office Word deployments. Additionally, defenders should review compensating controls to detect and prevent potential information disclosure and monitor for and respond to

Why it matters

CVE-2026-78522 is a Microsoft Office Word Information Disclosure Vulnerability that allows an unauthorized attacker to disclose information over a network. Defenders should prioritize verifying and updating Microsoft Office Word and related products to prevent potential information disclosure. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity.

• Verify and update Microsoft Office Word and related products to prevent potential information disclosure.
• Implement compensating controls to detect and prevent potential information disclosure.
• Monitor for and respond to potential security incidents related to this vulnerability.

Technical summary

The vulnerability is caused by an out-of-bounds read in Microsoft Office Word, allowing an unauthorized attacker to disclose information over a network. This vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. The vulnerability affects Microsoft Office Word and related products, and defenders should prioritize verifying and updating these products to prevent potential information disclosure.

Defensive priority

Defenders should prioritize verifying and updating Microsoft Office Word and related products to prevent potential information disclosure.

Recommended defensive actions

• Verify and update Microsoft Office Word and related products to the latest versions.
• Review and implement compensating controls to detect and prevent potential information disclosure.
• Monitor for and respond to potential security incidents related to this vulnerability.

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or impact. There is no evidence of public exploitation, but defenders should verify and update Microsoft Office Word and related products to prevent potential information disclosure. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. The source item and CVE record provide additional context on the vulnerability, but further information

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.