CVE-2026-66806

The 'local' qualifier in CVE-2026-66806 fundamentally restructures its threat model in ways the CVSS 5.5 score obscures. This is not a primary infection vector — it is a privilege-escalation or data-leakage primitive that requires the attacker to already have code execution or authenticated access on the target system. Treat it as a building block within a broader compromise chain, not as a standalone exploit. The off-by-one class is programmatically trivial — a single index miscalculated at a boundary — but its impact is entirely determined by what sits adjacent in memory or what data structure surrounds the errant access. The critical unanswered question is what this actually discloses: uninitialized heap bytes, heap metadata, or contents of an adjacent object? That distinction materially changes the risk calculus. The CVSS 5.5 score treats all information disclosures as equivalent, but a disclosure exposing previously-allocated session content is analytically distinct from one exposing allocator padding. The EPSS score of 0.00529 reflects current absence of automated exploitation infrastructure — but this is volatile for document parser bugs. Once a reliable trigger (a specific .docx structure) publishes, the exploitability landscape shifts. Local disclosure primitives have lower activation energy than remote exploits because they require only document interaction plus a second process on the same host, not network positioning. Defenders should prioritize understanding their deployment context. In shared workstation environments, RDP farms, or containerized Office installs where user boundaries are thin, this vulnerability's blast radius extends beyond a single session. The CVSS score may cause deprioritization in exactly the environments where it matters most. Additionally, off-by-one errors cluster in parser code due to cognitive complexity in handling variable-length encodings and boundary conditions — if this emerged from fuzzing or static analysis, treat it as a signal that the broader parsing code path likely contains similar errors. Patch it, but also flag the Word document parsing layer for systematic audit.

Reviewed through automated stages and approved by a human before publication.