CVE-2023-36761: Microsoft Word information disclosure via improper input validation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a KEV-listed, known-exploited Microsoft Word flaw, but the CVSS score is only 6.5 and the impact is limited to information disclosure.

What it is

CVE-2023-36761 is an information disclosure flaw in Microsoft Word and related Office products, rooted in improper input validation (CWE-20). The record gives only a one-line description, so the exact leaked data and the specific parsing path are not stated. It matters because the flaw is listed in CISA's Known Exploited Vulnerabilities catalog, meaning it has been exploited in the wild.

Impact

An attacker gains disclosure of information from the targeted system or document context; the CVSS vector rates confidentiality impact as High with no integrity or availability impact. The record does not specify which data is exposed.

Attack surface

Reached over the network (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R), consistent with a crafted document that the victim must open in Word. No authentication is needed on the attacker's side.

Exploitation

CISA added it to KEV on 2023-09-12 with a remediation due date of 2023-10-03, indicating known exploitation; EPSS is 0.1957 (97th percentile). No ransomware campaign use is documented.

What to do

• Apply the Microsoft patch from the MSRC update guide for CVE-2023-36761 across Word, Office, and Office Long Term Servicing Channel installations.
• If patching cannot be completed by the KEV due date, follow CISA guidance to apply vendor mitigations or discontinue use of the affected product.
• Block or quarantine untrusted Office documents at email and web gateways, and enforce Mark-of-the-Web so Protected View applies.
• Disable or restrict macros and other active content in documents arriving from external sources.
• Track patch compliance for Office 365 Apps and LTSC builds so the fix is not missed on long-lived channels.

Detection

• Monitor for Word processes spawning child processes or making unexpected outbound network connections after opening documents.
• Alert on Office documents opened from email attachments, downloads, or temp directories that trigger Word to read unusual file paths.
• Hunt for repeated Word crashes or abnormal document parsing behavior correlated with files from external senders.
• Review endpoint telemetry for suspicious file reads by WINWORD.EXE outside normal document locations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.