The CVSS 5.5 and low EPSS score on CVE-2026-70323 obscures a vulnerability class that functions as persistent reconnaissance infrastructure for sophisticated adversaries. The 'local' attack vector label is misleading: Microsoft Office processes untrusted file content by design, meaning every document opened by every employee is a local operation on adversarial input. The attack surface is universal, not narrow.
This is an information disclosure vulnerability in Office file parsing — the kind that exposes internal pathnames, usernames, SharePoint URLs, and tenant identifiers. That's not terminal exposure; it's a pivot point. The disclosed data feeds credential harvesting, Kerberoasting preparation, and lateral movement reconnaissance. An attacker doesn't need sophistication to start — they get that sophistication outsourced by the file parser. The data converts generic phishing into precision OAuth endpoint targeting.
The deeper problem is that each patch closes one node in a lineage, not the class itself. Microsoft has patched similar file parser CVEs — CVE-2024-21378, CVE-2023-33160, CVE-2023-36899 — across different parser branches (Excel binary format, legacy Word, embedded objects). Each fix touches the specific trigger path, but the shared parsing infrastructure — format normalization layers, binary format state machines, deprecated format handlers retained for backward compatibility — persists untouched. That's the sediment layer where new nodes spawn.
The low CVSS score produces a deprioritized remediation cycle: patch next month, not this week. That extended exposure window is where compounding happens. Across the product's lifetime, this class has functioned as a reliably available reconnaissance channel precisely because the scoring system keeps it below triage thresholds. The fix cycle times for comparable CVEs confirm the pattern — narrow patches, extended exposure, recurrence in adjacent parser paths within 18-24 months.
Practical response: treat file parser information disclosure in productivity software as a high-priority class regardless of individual CVSS scores. Prioritize patching these vulnerabilities faster than the score suggests. Implement detection for the specific exfiltration vectors — monitoring for outbound connections carrying pathnames, internal SharePoint URLs, or tenant identifiers from document parsing operations. Accept that this class requires standing remediation capacity rather than reactive patching, because the gap between disclosure and fix is where attackers compound the exposure.