CVE-2023-36761 is an information disclosure vulnerability in Microsoft Word. CISA added it to the Known Exploited Vulnerabilities catalogue on 12 September 2023, which means attackers have used it in real attacks. Microsoft Word contains an unspecified vulnerability that allows for information disclosure.
What this vulnerability means in Microsoft Word
An information disclosure flaw in a widely deployed document editor matters because the attack surface often begins with a file a user opens, previews, or processes during normal work. In practice, that means a malicious document can turn routine content handling into a confidentiality break, especially where sensitive text, embedded objects, or adjacent application state may be exposed.
For a vulnerability class like this, the core issue is not just that data can leak, but that the leak can happen through trusted software people already rely on. That combination makes the flaw attractive for targeted intrusion, staged access, and follow-on collection inside environments where Word documents are common business artifacts.
Why information disclosure is dangerous in office software
Information disclosure in productivity software can reveal content that was never meant to leave the local process, document boundary, or user session. Even when the flaw does not grant direct code execution, it can still expose material that helps an attacker understand the environment, identify valuable documents, or prepare a better second-stage exploit.
In office applications, the security consequence often comes from what the disclosed information enables next. Leaked document content, memory fragments, or protected metadata can support phishing refinement, credential harvesting, document targeting, or privilege discovery. That is why broadly classified disclosure bugs deserve attention alongside more obviously destructive vulnerabilities.
Because this CVE is already listed in the KEV catalogue, organisations should treat it as a real exploitation concern rather than a theoretical product issue. For the authoritative record and version details, readers should check the CVE Program and the NIST National Vulnerability Database, then align that information with the vendor advisory.
How organisations assess exposure and reduce risk
Exposure assessment starts with knowing where Microsoft Word is installed, which endpoints or virtual desktops can open untrusted files, and whether those systems are reachable by email, collaboration tools, browser downloads, or shared file locations. A vulnerability of this kind becomes more urgent when the affected application is present on systems handling sensitive correspondence, legal material, financial files, or regulated records.
Remediation typically follows standard vulnerability management practice, but the operational priority is to confirm scope quickly and remove exposure from the most likely delivery paths. Where patching is delayed, compensate by tightening document handling pathways, limiting exposure to untrusted content, and restricting which users or systems can process externally sourced files. The Vulnerability Management Guide is useful here because it frames the broader workflow of asset scope, KEV prioritisation, exceptions, and verification.
For this type of issue, compensating controls matter because the dangerous part is often the initial document interaction. Organisations should also review email filtering, sandboxing, and attachment handling so that a vulnerable application is less likely to see hostile input in the first place.
Detection and post-exploitation review
Detection for an information disclosure issue is harder than for obvious malware execution because the indicator may be the document itself, a suspicious delivery chain, or unusual access to files that should remain private. Security teams should look for abnormal document origin, repeated opens of the same file by multiple users, unusual archive or preview activity, and secondary access to sensitive materials shortly after a suspicious document is handled.
After patching, organisations should review whether the vulnerability was already exploited before the fix was applied. If the issue leaked sensitive content, the response is not complete until teams understand what the attacker may have seen, whether that information enabled later movement, and whether any dependent secrets, documents, or accounts need further review.
For exploited document flaws, the post-patch question is often whether the leak created an intelligence advantage rather than an immediate system takeover. That is still a serious compromise path, especially if the exposed material helps attackers target users, impersonate internal workflows, or select higher-value next steps.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | Requires tracking exploitable flaws like this KEV-listed Word issue. |
| SI-2 — Flaw Remediation | Directly supports patching and mitigation of an exploited software flaw. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Supports reviewing logs and evidence for suspicious document handling after exploitation. | |
| Recommendation — Prioritise and verify remediation for exposed systems running Microsoft Word. Apply the vendor fix and document any compensating controls until rollout completes. Review endpoint and document-access telemetry for signs of pre-patch abuse. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Addresses prioritising and remediating known exploited vulnerabilities across assets. |
| CIS-8 — Audit Log Management | Supports investigation of suspicious file access and post-exploitation review. | |
| Recommendation — Inventory Word installations and accelerate remediation of KEV-listed exposure. Preserve and analyse logs for abnormal document opens and sensitive-file access. | ||
Practitioner Guidance
Why practitioners should care: Treat KEV-listed disclosure bugs in office software as operationally urgent when the application sits on high-value endpoints or handles sensitive document flows. The main decision is not only whether a patch exists, but whether exposure has already been concentrated in the places an attacker is most likely to reach.
What to watch for: Prioritise systems that open external documents, shared workstations, and users who routinely receive untrusted files. If compromise is suspected, assume the attacker may have learned more from the disclosure than a simple file leak suggests.
Practitioner takeaway: A disclosure flaw should trigger both remediation and a content-exposure review, because the security impact can continue after the technical vulnerability is fixed.