Microsoft Office HTML Injection Information Disclosure Vulnerability

August 24th, 2026
ZDI-26-607 ZDI-CAN-29320

CVE ID

CVSS Score

7.6 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Affected Vendors

Microsoft

Affected Products

Office

Vulnerability Details

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Microsoft Office. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of query string parameters. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of arbitrary HTML. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.

Additional Details

Fixed in Microsoft Office Web home.office.com


Disclosure Timeline

  • 2026-03-03 - Vulnerability reported to vendor
  • 2026-08-24 - Coordinated public release of advisory
  • 2026-08-24 - Advisory Updated

Credit

kaijieguigui

Back to Advisories