Microsoft assigns CVE-2026-70105 a CVSS base score of 6.5 and a temporal score of 5.7. Its full CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C. The underlying weakness is CWE-20, improper input validation.
Microsoft’s central description says: “Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.” The accompanying advisory also says an attacker who successfully exploited the issue could potentially read small portions of heap memory. That places the practical exposure in data disclosure rather than code execution, file modification, or service interruption.
Publicly disclosed: No
Exploited: No
Customer action required: Yes
Microsoft’s exploitation assessment is Exploitation Less Likely. That assessment should guide triage, but it does not remove the need to patch systems that process documents from outside an organization, especially where staff routinely open Word attachments received through email, collaboration portals, or external partners.
What Microsoft says about the attack path
Microsoft’s advisory explicitly answers one common Word-security concern: “Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector.” The record therefore does not support treating a document merely appearing in Explorer’s Preview Pane as the triggering condition.
The CVSS vector includes UI:R, meaning user interaction is required. In operational terms, the vulnerability is most relevant where a user can be persuaded to interact with attacker-supplied Word content. Microsoft has not described an integrity or availability consequence: the score vector sets both I:N and A:N, while confidentiality is rated C:H.
There is a wording difference within the official advisory that administrators should read carefully rather than flatten into one claim. One advisory fact states, “Microsoft Office Word Information Disclosure Vulnerability: Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally.” Another states, “Microsoft Office Word Information Disclosure Vulnerability: Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.” Microsoft’s primary description uses the over-a-network wording, while its explanation of possible disclosure specifies that an attacker could read small portions of heap memory.
The affected Office and Word releases
CVE-2026-70105 affects both x86 and x64 installations in the Windows Office servicing lines Microsoft identifies, plus supported Mac releases. The practical complication is that most affected products do not have a single KB number or numerical fixed build in the advisory; Microsoft directs administrators to its Office security-release servicing channel instead.
The affected Windows products are Microsoft 365 Apps for Enterprise for 32-bit Systems (x86), Microsoft 365 Apps for Enterprise for 64-bit Systems (x64), Microsoft Office 2019 for 32-bit editions (x86), Microsoft Office 2019 for 64-bit editions (x64), Microsoft Office LTSC 2021 for 32-bit editions (x86), Microsoft Office LTSC 2021 for 64-bit editions (x64), Microsoft Office LTSC 2024 for 32-bit editions (x86), and Microsoft Office LTSC 2024 for 64-bit editions (x64).
Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 are also affected. For each of those Mac products, Microsoft specifies fixed build 16.112.26081010.
Microsoft Word 2016 remains separately identified for both architectures: Microsoft Word 2016 (32-bit edition) (x86) and Microsoft Word 2016 (64-bit edition) (x64). Each requires KB5002901 and fixed build 16.0.5565.1000. That separate KB path matters for patch management: a deployment report showing a current Microsoft 365 Apps update does not establish that standalone Word 2016 installations have received KB5002901.
Remediation paths and fixed builds
For Microsoft 365 Apps for Enterprise for 32-bit Systems (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later. For Microsoft 365 Apps for Enterprise for 64-bit Systems (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office 2019 for 32-bit editions (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later. For Microsoft Office 2019 for 64-bit editions (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office 365 for Mac, update to fixed build 16.112.26081010 or later.
For Microsoft Office LTSC 2021 for 32-bit editions (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later. For Microsoft Office LTSC 2021 for 64-bit editions (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office LTSC 2024 for 32-bit editions (x86), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later. For Microsoft Office LTSC 2024 for 64-bit editions (x64), update to fixed build Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn or later.
For Microsoft Office LTSC for Mac 2021, update to fixed build 16.112.26081010 or later. For Microsoft Office LTSC for Mac 2024, update to fixed build 16.112.26081010 or later.
For Microsoft Word 2016 (32-bit edition) (x86), install KB5002901 to reach fixed build 16.0.5565.1000. For Microsoft Word 2016 (64-bit edition) (x64), install KB5002901 to reach fixed build 16.0.5565.1000.
A deployment check should distinguish servicing models
The MSRC record’s split between channel-serviced Office products and Word 2016 is the key administrative consequence of this bulletin. Security teams should inventory Office installation type and architecture before marking the CVE remediated: Microsoft 365 Apps, Office 2019, Office LTSC 2021, and Office LTSC 2024 follow the security-release build guidance, whereas Word 2016 has the explicit KB5002901 requirement.
Mac fleet owners have a simpler measurable threshold: Office 365 for Mac, Office LTSC for Mac 2021, and Office LTSC for Mac 2024 should be at 16.112.26081010 or later. On Windows, verify that the relevant Office servicing update has installed for the product actually present, rather than relying on a generic Windows cumulative-update compliance signal.
The immediate action is to deploy the applicable Office update or KB5002901, then confirm the resulting build on endpoints. Microsoft’s advisory says the Preview Pane is not an attack vector, but the required user interaction and “Exploitation Less Likely” assessment are reasons to prioritize informed patch rollout—not reasons to leave document-handling endpoints behind the fixed versions.