CVE-2026-70130

This vulnerability is like a mistake in Microsoft Office’s “memory handling” that can be abused to make your computer do something harmful instead of what the user intended. For a business, that means an attacker may be able to run malicious code on a device that has the vulnerable Office version installed, potentially leading to data theft or disruption.

This matters if your business runs Microsoft 365 Apps, Microsoft Office, or Office 2019/2021/2024 on Windows and those installed versions include the vulnerable code. It is a local risk: the attacker must be able to reach the vulnerable Office installation on a local machine. Because it does not require a login or user action, you should treat any device where attackers can gain local access as higher risk.

This is urgent because the issue enables attackers to run code locally by triggering a memory error in Microsoft Office, and it requires neither authentication nor user interaction. Even though the provided sources do not confirm public exploitation for this exact CVE, the overall risk profile is high and Microsoft has released fixes.

1. Confirm what you have

   • Identify installed Microsoft Office product(s): Microsoft 365 Apps, Microsoft Office, Office 2019, Office 2021, Office 2024.
   • Capture your current Office version/build number from the Office app (typically under Account or About).

2. Determine whether you’re vulnerable

   • Go to Microsoft’s Office Security Releases / MSRC update guide for CVE-2026-70130.
   • Match your current Office build against Microsoft’s listed fixed releases for CVE-2026-70130.
   • If Microsoft’s guide indicates your build is vulnerable, plan for an update.

3. Patch

   • Install the security update Microsoft provides for CVE-2026-70130 via the Office Security Releases and MSRC update guide.
   • If you manage devices with IT tooling (Update Rings/WSUS/Intune/SCCM), deploy according to your normal Office update process, prioritizing business-critical endpoints.

4. Verify

   • After updating, check the Office build number again to confirm it matches a fixed release listed for CVE-2026-70130.

5. Temporary workaround (if patching is delayed)

   • Reduce the chance an attacker can reach the local machine where Office is installed (for example, limit local access to endpoints and tighten physical/logon access controls).
   • Minimize exposure to untrusted devices/files that could be used to trigger harmful behavior within Office.

6. What to monitor

   • Watch for unexpected Office behavior shortly after unusual activity (new processes spawned by Office, unexpected network connections, or suspicious child processes).
   • Review endpoint security logs for signs of local exploitation attempts targeting Office.

CVE-2026-70130 (CWE-122) describes a memory-handling flaw in Microsoft Office that can be triggered to cause a heap-based buffer overflow. The findings characterize it as local code execution: an attacker can make the computer perform harmful actions by tricking Microsoft Office into using too much memory space. Conditions from the findings include: vulnerable Office is installed and accessible locally; no authentication is required; no user interaction is required.

Verdict context: This issue is marked RED for urgency in this assessment. The provided sources do not list it in the CISA KEV catalog, and no dated public exploitation claim or public exploit code was provided. Patch information is available via Microsoft’s MSRC update guide and the Office Security Releases page.

Exploitation maturity (from provided sources): no confirmed public exploit or clear dated exploitation claim was included here; however, press attention referenced a threat actor (Lazarus group) in connection with patch activity, which increases attention on the risk even without KEV confirmation.