Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-70323: Microsoft Office Discloses Sensitive Information Locally

CVE-2026-70323 · published 2 months ago

Summary

Microsoft Office software may reveal sensitive information to unauthorized users on the same computer. This could happen if an attacker exploits a weakness in the software's input validation. To protect your data, ensure you're running the latest version of Microsoft Office and be cautious when opening files from unknown sources.

What to do

Update microsoft microsoft 365 apps for enterprise to version https://aka.ms/OfficeSecurityReleases or later.
Update microsoft microsoft office 2019 to version https://aka.ms/OfficeSecurityReleases or later.
Update microsoft microsoft office 365 for mac to version 16.112.26081010 or later.
Update microsoft microsoft office ltsc 2021 to version https://aka.ms/OfficeSecurityReleases or later.
Update microsoft microsoft office ltsc 2024 to version https://aka.ms/OfficeSecurityReleases or later.
Update microsoft microsoft office ltsc for mac 2021 to version 16.112.26081010 or later.
Update microsoft microsoft office ltsc for mac 2024 to version 16.112.26081010 or later.

Affected software

Vendor	Product	Affected versions
microsoft	microsoft 365 apps for enterprise	< https://aka.ms/OfficeSecurityReleases 16.0.1
microsoft	microsoft office 2019	< https://aka.ms/OfficeSecurityReleases 19.0.0
microsoft	microsoft office 365 for mac	< 16.112.26081010
microsoft	microsoft office ltsc 2021	< https://aka.ms/OfficeSecurityReleases 16.0.1
microsoft	microsoft office ltsc 2024	< https://aka.ms/OfficeSecurityReleases 16.0.0
microsoft	microsoft office ltsc for mac 2021	< 16.112.26081010
microsoft	microsoft office ltsc for mac 2024	< 16.112.26081010
microsoft	365_apps	All versions `cpe:2.3:a:microsoft:365_apps:-::::enterprise::x64:*`
microsoft	microsoft_365	All versions `cpe:2.3:a:microsoft:microsoft_365:-:::::macos::`
microsoft	office_2019	All versions `cpe:2.3:a:microsoft:office_2019:-::::::x64:`
microsoft	office_2021	All versions `cpe:2.3:a:microsoft:office_2021:-::::ltsc:-:x64:`
microsoft	office_2024	All versions `cpe:2.3:a:microsoft:office_2024:-::::ltsc:-:x64:`

Original advisory text

Microsoft Office Information Disclosure Vulnerability

Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70323 vendor-advisory patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published11 Aug 2026

Updated4 Nov 2026

First seen11 Aug 2026

Sources

CVE-2026-70323 · NVD

CVE-2026-70323 · MITRE

Track software like this

Free during beta