CVE-2026-20944
Published: 13 January 2026
Summary
CVE-2026-20944 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Microsoft 365 Apps. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely identification, reporting, and remediation of flaws, including applying patches for the out-of-bounds read vulnerability in Microsoft Office Word.
Requires scanning systems for vulnerabilities like CVE-2026-20944 in Microsoft Office Word to identify affected instances prior to exploitation.
Implements memory protection mechanisms such as non-executable memory and randomization to mitigate exploitation of the out-of-bounds read vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local out-of-bounds read in Office Word directly enables arbitrary code execution, mapping to client-side exploitation (T1203) and local privilege escalation (T1068).
NVD Description
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Deeper analysisAI
CVE-2026-20944, published on 2026-01-13, is an out-of-bounds read vulnerability (CWE-125) affecting Microsoft Office Word. The issue carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts.
An unauthorized attacker with local access to the system can exploit this vulnerability with low complexity and no privileges or user interaction required. Successful exploitation allows the attacker to execute arbitrary code locally on the affected machine.
Microsoft's Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20944 provides details on patches and mitigation steps.
Details
- CWE(s)