CVE-2026-42832
Full vulnerability record from the local CVENow database.
Description
Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-12 18:17:25.800000
Last modified
2026-10-26 18:10:00.173000
View original CVE JSON
{
"id": "CVE-2026-42832",
"sourceIdentifier": "[email protected]",
"published": "2026-05-12T18:17:25.800",
"lastModified": "2026-10-26T18:10:00.173",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally."
},
{
"lang": "es",
"value": "Control de acceso inadecuado en Microsoft Office permite a un atacante no autorizado realizar suplantación de identidad localmente."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Microsoft Excel for Android",
"versions": [
{
"version": "16.0.0.0",
"lessThan": "16.0.19822.20190",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Office LTSC for Mac 2021",
"versions": [
{
"version": "16.0.1",
"lessThan": "16.109.26051019",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Office LTSC for Mac 2024",
"versions": [
{
"version": "16.0.0",
"lessThan": "16.109.26051019",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Word for Android",
"versions": [
{
"version": "16.0.0.0",
"lessThan": "16.0.19822.20190",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.5,
"impactScore": 5.2
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-12T18:54:19.688774Z",
"id": "CVE-2026-42832",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:excel:*:*:*:*:*:android:*:*",
"versionEndExcluding": "16.0.19822.20190",
"matchCriteriaId": "CDB078AF-7792-4833-8901-3DE793C08843"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:office:2024:*:*:*:ltsc:macos:*:*",
"matchCriteriaId": "873BD998-9D5A-4C09-A3B3-4DB12ABB6F72"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*",
"matchCriteriaId": "BF0E8112-5B6F-4E55-8E40-38ADCF6FC654"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:word:*:*:*:*:*:android:*:*",
"versionEndExcluding": "16.0.19822.20190",
"matchCriteriaId": "8299056B-8884-4A3E-B91F-3E69AB135AF8"
}
]
}
]
}
],
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42832",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}