{"id":"CVE-2026-69609","aliases":[],"cve":{"records":[{"id":"CVE-2026-69609","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-03T21:21:00.594Z","published":"2026-09-08T17:11:49.837Z","modified":"2026-10-30T21:50:16.845Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-10-30T21:50:16.845Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-08T20:25:52.214Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69609","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-125","description":"CWE-125: Out-of-bounds Read","source":"microsoft"},{"id":"CWE-193","description":"CWE-193: Off-by-one Error","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office:*:*:android:*:*:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"16.0.20430.20000"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"16.112.26090911"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.112.26090911"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"16.112.26090911"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-08T19:51:32.936992Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Win32k Information Disclosure Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally.","score":5.5,"severity":"medium","published":"2026-09-08T17:11:49.837Z","modified":"2026-10-30T21:50:16.845Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Microsoft Office 365 for Mac","platforms":[],"versions":[{"version":"1.0.0","status":"affected","lessThan":"16.112.26090911","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69609"},{"vendor":"Microsoft","name":"Microsoft Office for Android","platforms":[],"versions":[{"version":"16.0.1","status":"affected","lessThan":"16.0.20430.20000","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69609"},{"vendor":"Microsoft","name":"Microsoft Office LTSC for Mac 2021","platforms":[],"versions":[{"version":"16.0.1","status":"affected","lessThan":"16.112.26090911","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69609"},{"vendor":"Microsoft","name":"Microsoft Office LTSC for Mac 2024","platforms":[],"versions":[{"version":"16.0.0","status":"affected","lessThan":"16.112.26090911","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69609"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69609"],"sources":[{"name":"CVE","id":"CVE-2026-69609","modified":"2026-10-30T21:50:16.845Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-69609"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","score":5.5}],"sourceAffected":[],"observedAt":"2026-10-30T22:45:34.920Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T11:20:32.820Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Microsoft Office products are affected by an out-of-bounds read vulnerability in Windows Win32K, allowing an authorized attacker to disclose information locally. Affected versions include Microsoft Office 365 for Mac, Microsoft Office for Android, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. The vulnerability is due to CWE-125: Out-of-bounds Read.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T04:21:07.435Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-69609"}]}}