CVE-2026-70317

Think of Microsoft Office like a software “locker” that prepares items before you use it. In this bug, the locker sometimes forgets to properly prepare certain parts, so opening a specially crafted document could accidentally spill some information that should have stayed hidden. The trick usually requires someone with access to the computer and a user opening the file.

This matters if your business uses Microsoft Office products listed in the affected set (Microsoft 365 apps / Microsoft Office and Microsoft Office for Mac and LTSC for Mac 2021/2024). The main risk is not random internet attacks; it requires local access or a local session on the device and user interaction to open a crafted document. It’s only a meaningful risk when an attacker can get onto the machine (or you already have malware) and can get a user to open the malicious file.

Verdict: RED. Even though this requires local access and a user to open a crafted file, the combination is realistic in targeted attacks where devices are already compromised or in active intrusions. Treat it as urgent to patch because Office is commonly used across businesses and attackers (including reported activity tied to Lazarus group in the findings) focus on Office weaknesses.

1. Inventory your Office installations

   • Identify whether devices run Microsoft 365 apps, Microsoft Office (Windows), Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024.
   • Record the installed Office version number on each device.

2. Determine whether you’re exposed (quick check)

   • If you’re on Microsoft Office (Windows), you should be at least 16.0.5565.1001.
   • If you’re on Microsoft Office 365 for Mac or Office LTSC for Mac (2021 or 2024), you should be at least 16.112.26081010.
   • Use your normal software inventory method (IT management console, endpoint management, or per-device version checks in Office/About) to verify all endpoints are updated.

3. Upgrade to the fixed version

   • Windows (Microsoft Office): upgrade to 16.0.5565.1001.
   • macOS (Microsoft Office 365 for Mac; LTSC for Mac 2021/2024): upgrade to 16.112.26081010.
   • Follow Microsoft’s update guidance for your organization’s update channel from the Microsoft Update Guide linked in the findings.

4. If patching is delayed (temporary risk reduction)

   • Tighten document handling: restrict opening attachments from email/IM sources that aren’t fully trusted.
   • Ensure Office security features are enabled (so Office prompts/safety checks activate when opening files from untrusted locations).
   • Prioritize patching for devices with the highest exposure (accounts with access to sensitive documents and devices used by staff who receive frequent external files).

5. What to monitor after updating

   • Confirm Office version numbers match the fixed releases on all targeted devices.
   • Review endpoint activity around the time of any suspected “opened attachment” incidents (e.g., unusual processes shortly after opening documents), even though this specific flaw is an information disclosure issue.

CVE-2026-70317 is an information disclosure vulnerability (CWE-908) in Microsoft Office where certain resources are not properly initialized before use. The findings indicate the attack is local: an attacker needs physical access or an existing local session, and user interaction is required (a user must open a specifically crafted Office document to trigger the disclosure). There is no KEV listing, no clear dated press exploitation claim, and no public exploit code on record in the provided findings; however, the traffic-light verdict is RED and the findings note new press attention tied to patching and actor reporting (Lazarus group).

Fix availability is confirmed in the findings: Microsoft Office fixed in 16.0.5565.1001 (Windows) and Microsoft Office 365 for Mac / Office LTSC for Mac 2021 / Office LTSC for Mac 2024 fixed in 16.112.26081010 (macOS). The EPSS value provided is a prediction only and is not used as a deciding factor here.