## Summary
CVE-2026-70130 describes a heap-based buffer overflow in Microsoft Office that can allow an unauthorized local attacker to execute code on the affected system. The NVD indicates the issue results in confidentiality, integrity, and availability impact.
## Technical Details
- Vulnerability type: Heap-based buffer overflow
- CWE: CWE-122
- Reported effect: local code execution in Microsoft Office
- CVSS (NVD): 8.4 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
## Affected
- Product family: Microsoft Office (specific affected versions not provided in the available data)
## Impact
- Local attacker code execution (per NVD description)
- Potential outcomes include:
- Confidentiality impact: C:H
- Integrity impact: I:H
- Availability impact: A:H
## Mitigation
1. Apply vendor security updates/patches for Microsoft Office once identified for your installed version(s).
2. Reduce local attacker exposure by tightening endpoint access controls (since the vector is AV:L and prerequisites are PR:N per NVD).
3. Monitor for anomalous Office process behavior and unexpected child process creation (exact detection indicators not available from the provided references).
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-122