Information disclosure via uninitialized resource

Information disclosure in Microsoft Office before the August 11, 2026 updates allows local users to read uninitialized memory contents. Microsoft has disclosed only that Office uses an uninitialized resource; no retrieved vendor advisory, CVE record, or support bulletin names the affected component or the operation that returns stale data. Microsoft's CVSS assessment requires no prior privileges but does require user interaction and local execution context, so reachability depends on a user opening or otherwise processing attacker-supplied Office content.