CVE-2026-70315

CVE-2026-70315 presents as an out-of-bounds read in Microsoft Office with a CVSS 5.5 rating and 'local' attack vector. That scoring profile warrants skepticism. The EPSS score of 0.00477 indicates near-zero probability of automated exploitation within 30 days — which, combined with the 'local' qualifier, suggests this is a post-authentication or post-compromise reconnaissance vector. The attacker already needs something close to code execution to trigger it, making the standalone information disclosure largely redundant in realistic scenarios. The 'unauthorized' language in the description is the underappreciated signal. In Microsoft's CVSS taxonomy, this distinguishes between a read that exceeds bounds within an authorized context versus one that violates an access control boundary — specifically, it indicates the memory region was nominally protected. That positions this as a potential credential-material-access vulnerability: if the OOB read can cross session boundaries or access token-adjacent memory regions, the 5.5 rating becomes a classification failure rather than an accurate severity assessment. The historical pattern matters more than the individual CVE. OOB reads in Office parser components have been reliable chain fodder since the Office 2007 file format rewrite. This isn't coincidence — it's structural memory management debt in a decades-old polyglot codebase. The same engineering dynamics that produced past chainable memory disclosures are baked into the patch development pipeline, meaning recurrence is predictable rather than exceptional. For defenders: treat this as chain-compatible until proven otherwise. Prioritize determining what memory regions this read can access — if it exposes credentials, tokens, or cryptographic material, escalate severity internally regardless of the CVSS. In containerized or shared-environment deployments, the 'local' attack surface may be dramatically smaller than the CVSS assumes, since container namespaces and mounted filesystem contexts collapse the preconditions. The exposure window matters more than the exploitation probability — low-severity CVEs consistently receive deprioritized patching, creating accumulated exposure that attackers can assemble into chains over months, not days.

Reviewed through automated stages and approved by a human before publication.