CVE-2026-72976: Out-of-Bounds Read in Microsoft Defender Business
Severity: MEDIUM (CVSS 5.0)
Affected Product:
- Microsoft Defender Business
Vulnerability Description: Out-of-bounds read in Microsoft Office Word allows an authorized attacker to disclose information locally.
KEV Status: Not currently exploited in the wild
Remediation:
- Review Microsoft Security Response Center (MSRC) guidance: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72976
- Apply available security updates from Microsoft when released
- Restrict local access to untrusted users where possible
Impact: Local information disclosure only; requires authorization to exploit.