CVE-2026-70130

This vulnerability is like a mistake in Microsoft Office’s “memory handling” that can be abused to make your computer do something harmful instead of what the user intended. For a business, that means an attacker may be able to run malicious code on a device that has the vulnerable Office version installed, potentially leading to data theft or disruption.

This matters if your business runs Microsoft 365 Apps, Microsoft Office, or Office 2019/2021/2024 on Windows and those installed versions include the vulnerable code. It is a local risk: the attacker must be able to reach the vulnerable Office installation on a local machine. Because it does not require a login or user action, you should treat any device where attackers can gain local access as higher risk.

This is urgent because the issue enables attackers to run code locally by triggering a memory error in Microsoft Office, and it requires neither authentication nor user interaction. Even though the provided sources do not confirm public exploitation for this exact CVE, the overall risk profile is high and Microsoft has released fixes.