CVE-2026-70130 is a high severity flaw in Microsoft Office, scored 8.4 by the record. Per the NVD record, it allows an unauthorized attacker to execute code locally. The record does not state a fixed build, so use the Microsoft advisory for the update that applies to your version and apply it.
What's affected
The NVD record lists these affected products: 365 apps; Office 2019; Office 2021; Office 2024.
The record describes the issue this way: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
The record gives a CVSS 3.1 base score of 8.4 (HIGH), published 2026-08-11, with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vector reads as follows. Access is locally, attack complexity is low, and privileges required are none. No user interaction is needed. Scope is unchanged. Confidentiality, integrity and availability impact are high, high and high.
The advisory is the authority on build numbers, and our automated fetch of the Microsoft page returned no advisory text, so this guide stops at what the NVD record states. Where Microsoft's advisory differs from this record on severity or versions, trust the advisory and note the difference in your own tracking.
How to check if you're exposed
Find the installed Office build and update channel, then compare them to the fixed build in the advisory.
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration').VersionToReport
In any Office app you can also open File, then Account, and read the version under About. Volume-licensed MSI installs of older suites are patched through Windows Update or your update server, so check those separately.
What to do now
- Read the Microsoft advisory and note the fixed build for your channel.
- Update Office through your usual channel and ask users to restart their Office apps.
- Until patched, treat unexpected documents from outside the company with extra care.
- Confirm the new build number on a sample of machines.
Why it matters
CWE-122 (heap-based buffer overflow) describes a weakness where data is written past the end of a heap allocation and damages neighboring memory.
Desktop software processes content that arrives from outside the company, such as documents, links and extensions. That makes user behavior and update discipline part of the exposure, and it is why patching speed varies so much between teams.
The record's kev field is false, so the record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and no fetched advisory said it was exploited. That is a snapshot, not a promise, so keep watching.
Safeguard's Gold page for this CVE tracks the record, and the free in-browser scan can check dependency manifests for related issues. Reachability analysis helps with libraries, though it does not apply to operating system patches.
Quick check
Does this CVE appear in the CISA Known Exploited Vulnerabilities list?
The record's kev field is false, so it is not listed in CISA's catalog as of the record we hold. That can change, so check the catalog if you are prioritizing.
Is the Preview Pane involved?
The record does not say. The advisory should state whether Preview Pane is an attack vector, so read it before deciding on interim controls.
Sources
- Microsoft Security Update Guide entry for CVE-2026-70130 (the page did not return readable advisory text to our automated fetch, so confirm details there)
- NVD record for CVE-2026-70130 as supplied in the Safeguard batch data
Last reviewed: 18 October 2026.
