CVE-2026-35440 Details

A vulnerability in Microsoft Office Word allows unauthorized attackers to disclose information locally by accessing files or directories available to external parties. This issue affects multiple versions of Word, including Word 2016, Word 2019, Word 2021, and Word LTSC 2024, across both 32-bit and 64-bit editions. The vulnerability arises from the application's handling of accessible files and directories, which can be exploited to reveal sensitive information, such as local memory addresses.

Users can download the security update for this vulnerability from the Microsoft Update Catalog. For Microsoft Word 2016, the security update is available through the same link for both 32-bit and 64-bit editions. Microsoft Office LTSC 2024, LTSC 2021, and Office 2019 users can also download the security update from the Microsoft Update Catalog. Additionally, Microsoft 365 Apps for Enterprise users can access the security update through the Click to Run service.