CVE-2026-70317

Think of Microsoft Office like a software “locker” that prepares items before you use it. In this bug, the locker sometimes forgets to properly prepare certain parts, so opening a specially crafted document could accidentally spill some information that should have stayed hidden. The trick usually requires someone with access to the computer and a user opening the file.

This matters if your business uses Microsoft Office products listed in the affected set (Microsoft 365 apps / Microsoft Office and Microsoft Office for Mac and LTSC for Mac 2021/2024). The main risk is not random internet attacks; it requires local access or a local session on the device and user interaction to open a crafted document. It’s only a meaningful risk when an attacker can get onto the machine (or you already have malware) and can get a user to open the malicious file.

Verdict: RED. Even though this requires local access and a user to open a crafted file, the combination is realistic in targeted attacks where devices are already compromised or in active intrusions. Treat it as urgent to patch because Office is commonly used across businesses and attackers (including reported activity tied to Lazarus group in the findings) focus on Office weaknesses.