CVE-2026-66809

This CVE describes an out-of-bounds read vulnerability in a Microsoft Office document parser. The CVSS score of 5.5 reflects a 'local' attack vector, but that label is misleading in enterprise environments where document exchange happens continuously over email, shared drives, SharePoint, and Teams. A 'local' attacker in this context is anyone who can deliver a malformed document to a target — not someone with console access. The actual blast radius extends far beyond the end user who opens the file: email gateways, DLP scanners, preview services, and co-authoring pipelines all process these documents without user interaction, creating a processing surface that touches every document in your environment. The more important framing question is what this vulnerability represents in aggregate. Parser-layer information disclosures are not isolated findings — they form a documented lineage that researchers rediscover repeatedly as fuzzing coverage improves. History shows these bugs get weaponized six to eighteen months after disclosure, transforming from 'medium' info disclosure into reliable exploitation enablers for memory corruption variants. One out-of-bounds read doesn't just leak data; it contributes to a cumulative memory layout map that makes every other memory corruption bug in that process exploitable. If your organization has recently patched an RCE in the same parser, this CVE becomes the missing link that makes the next heap spray reliable. Treat this as a critical-priority patch regardless of the CVSS score. Your patch SLA for parsing-layer information disclosures should reflect their role as exploitation prerequisites, not just data leak incidents. The formats involved — legacy Word, RTF, old Excel binary structures — are functionally abandoned code paths maintained only for backward compatibility, meaning they're unlikely to receive intensive security investment going forward. Each unpatched instance represents ongoing intelligence collection by adversaries building exploitation infrastructure against your document processing fleet.

Reviewed through automated stages and approved by a human before publication.