This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Microsoft Office fixes an actively exploited vulnerability

Microsoft Office fixes a high-severity, actively exploited vulnerability [1][2]. Fixed product versions: - Microsoft Office 2021 and later, Microsoft 365 - automatic fix (restart required) - Microsoft Office 2019 (32-bit and 64-bit) - 16.0.10417.20095 - Microsoft Office 2016 (32-bit and 64-bit) - 16.0.5539.1001

Microsoft Office, 365 - security bypass (CVE-2026-21509)
CVSS 7.8 (High)

An unauthenticated local attacker can, by sending a specially crafted file and using social engineering, bypass the protection mechanisms preventing the abuse of COM/OLE objects, which can potentially lead to data leakage/modification, a DoS attack or code execution. The Outlook Preview Pane is not an attack vector. If an immediate update is not possible, the risk can be temporarily mitigated by blocking the vulnerable COM object in the registry. Detailed instructions for various installation versions can be found at [1].

The vulnerability is present in products:

  • Microsoft Office 2016; <16.0.5539.1001;
  • Microsoft Office 2019; <16.0.10417.20095;

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 26. 1. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 27. 1. 2026.

CESNET, z.s.p.o. Logo