Microsoft Security Update Guide · Office / Microsoft 365 Apps
Microsoft Office Word Information Disclosure Vulnerability
Published · updated 24 sep 2026
What does this mean?
- Information Disclosure. An attacker can see information that is not meant for them.
- It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
- CVSS 5.5 out of 10: medium. Microsoft rates it Important.
- No attacks reported; Microsoft expects exploitation to be less likely.
- What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Word 2016 (64-bit edition): KB5002901
16.0.5565.1000 - Microsoft Word 2016 (32-bit edition): KB5002901
16.0.5565.1000 - Microsoft Office LTSC 2024 for 64-bit editions: KBClick to Run
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 32-bit editions: KBClick to Run
https://aka.ms/OfficeSecurityReleases - Microsoft Office LTSC 2021 for 64-bit editions: KBClick to Run
https://aka.ms/OfficeSecurityReleases
- Microsoft Word 2016 (64-bit edition): KB5002901
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
What kind of flaw is this?
- CWE-125: Out-of-bounds Read
The program reads outside its allocated memory and can leak information.
Key facts
Released
11 aug 2026
Last revised
24 sep 2026 (v1.1)
Impact
Information Disclosure
Max severity
Important
Weakness
CVSS 3.1
5.5 / 4.8 (base / temporal)
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:CPublicly disclosed
No
Exploited
No
Exploitability assessment
Exploitation Unlikely
Customer action required
Yes
Links
CVSS metrics
| Base score metrics | |
|---|---|
| Attack Vector | Local |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity | None |
| Availability | None |
| Temporal score metrics | |
| Exploit Code Maturity | Unproven |
| Remediation Level | Official Fix |
| Report Confidence | Confirmed |
Affected products and updates
| Product | Update | Build |
|---|---|---|
| Microsoft Word 2016 (64-bit edition) | KB5002901 · Security Update | 16.0.5565.1000 |
| Microsoft Word 2016 (32-bit edition) | KB5002901 · Security Update | 16.0.5565.1000 |
| Microsoft Office LTSC 2024 for 64-bit editions | KBClick to Run | https://aka.ms/OfficeSecurityReleases |
| Microsoft Office LTSC 2024 for 32-bit editions | KBClick to Run | https://aka.ms/OfficeSecurityReleases |
| Microsoft Office LTSC 2021 for 32-bit editions | KBClick to Run | https://aka.ms/OfficeSecurityReleases |
| Microsoft Office LTSC 2021 for 64-bit editions | KBClick to Run | https://aka.ms/OfficeSecurityReleases |
| Microsoft 365 Apps for Enterprise for 64-bit Systems | KBClick to Run | https://aka.ms/OfficeSecurityReleases |
| Microsoft 365 Apps for Enterprise for 32-bit Systems | KBClick to Run | https://aka.ms/OfficeSecurityReleases |
| Microsoft Office 2019 for 64-bit editions | KBClick to Run | https://aka.ms/OfficeSecurityReleases |
| Microsoft Office 2019 for 32-bit editions | KBClick to Run | https://aka.ms/OfficeSecurityReleases |
FAQ
- What type of information could be disclosed by this vulnerability?
- An attacker who successfully exploited this vulnerability could potentially read portions of process memory.
- Is the Preview Pane an attack vector for this vulnerability?
- No, the Preview Pane is not an attack vector.
Revisions
| Version | Date | Note |
|---|---|---|
| 1.1 | 24 sep 2026 | Updated an acknowledgement. This is an informational change only. |
| 1 | 11 aug 2026 | Information published. |
This is in the weekly digest for week 39 · What changed this week? →
View at Microsoft → ← All security advisories
Source: Microsoft Security Update Guide. 365Fanatic is not affiliated with Microsoft.
