CVE-2026-66809

MediumCVSS 5.5/10Last modified Aug 14, 2026

Description

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2026
Last modified
Aug 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-66815.3The PKCS#7 decode path ignores the caller-supplied output buffer size (outputSz), allowing decoded content to be written past the bounds of CVE-2026-668105.5Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2026-668148.8Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-668166.5Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a network.CVE-2026-668188.8Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-668198.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2026-66827.6In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-CVE-2026-668208.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2026-668225.9Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.CVE-2026-668249.2A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture CVE-2026-668256.9Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, CVE-2026-668296.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker
CVE-2026-66809: Medium severity, CVSS 5.5 | Vulnix