CVE-2026-21509 — Educational Dummy PoC for Defender Visibility

⚠️ This repository provides a harmless, non-exploit Proof of Concept.
Its purpose is to support defensive research, EDR/AV visibility testing, and training.
It does not exploit CVE‑2026‑21509 and contains only dummy OLE artifacts.

---

📝 Overview

This repository contains an educational PoC simulating structural markers related to CVE‑2026‑21509, a Microsoft Office security feature bypass vulnerability.
The PoC generates a harmless DOCX file containing dummy embedded OLE components for telemetry observation, sandbox analysis, EDR rule validation, and SOC training.

Nothing in this repository is malicious.
No code execution, no exploit chain, no harmful objects.

---

📌 About CVE‑2026‑21509

CVE‑2026‑21509 is a security feature bypass in Microsoft Office caused by reliance on untrusted inputs in a security decision, allowing an unauthorized attacker to bypass OLE protections locally after the user opens a crafted document. 1

The vulnerability:

• Allows bypass of OLE mitigations in Microsoft Office and Microsoft 365 Apps. 2
• Requires user interaction (the victim must open the file). 2
• Preview Pane is not an attack vector. 2
• Has a CVSS v3.1 score of 7.8 (High). 1
• Is included in the CISA Known Exploited Vulnerabilities (KEV) catalog. 1

Affected product families

According to Microsoft and multiple advisories, the following are impacted:

• Office 2016
• Office 2019
• Office LTSC 2021
• Office LTSC 2024
• Microsoft 365 Apps for Enterprise 2

---

🎯 Purpose of This PoC

This project exists only to:

• Help blue teams understand Office file structures related to OLE.
• Provide a safe sample to test:
  • EDR detections
  • ASR (Attack Surface Reduction) rules
  • MOTW/Protected View behavior
  • Sandbox analysis workflows
• Train SOC analysts on document‑based threat hunting.

Again:

❗ This PoC does NOT exploit CVE‑2026‑21509.
It only simulates harmless structural patterns for learning and detection testing.

---

🔍 Inspecting the DOCX with 7‑Zip

You can analyze the generated file using 7‑Zip:

1. Right‑click the file → Open archive (7‑Zip)
2. Inspect internal ZIP structure:
   • word/document.xml
   • word/_rels/document.xml.rels
   • word/embeddings/ (dummy oleObjectX.bin)
3. Extract for offline analysis, signature development, etc.

This helps defenders understand object relationships inside Office documents without risk.

---

🧪 Blue Team / EDR Checklist

When opening the dummy DOCX in an isolated environment, watch for:

• Office’s behavior when reading OLE relationships
• Registry access related to COM/OLE policy checks
• ASR rule triggers
• EDR telemetry for:
  • OLE object parsing
  • Office trust-policy evaluations
  • Protected View transitions
  • Any unexpected module loads

Reference OLE/COM behavior patterns explained in Microsoft’s advisory and analysis of CVE‑2026‑21509. 3

---

🔧 Mitigation (Real Vulnerability Context)

Microsoft has released:

• Out‑of‑band patches for multiple Office versions. 2
• Service‑side protections for Office 2021+ (restart required). 2
• Temporary registry-based COM kill-bit mitigation for Office 2016/2019 until patches roll out. 2

CISA requires organizations to apply mitigations by the deadline listed in the KEV catalog. 1

---

⚖️ Legal & Ethical Notice

• Use only in isolated lab environments.
• Do not send the file to production mailboxes or endpoints.
• The maintainers are not responsible for misuse.
• This PoC includes no malicious payloads, no exploit chain, no harmful logic.

---

📚 References

• NVD CVE‑2026‑21509 Entry 1
• BleepingComputer OOB Patch Analysis 2
• TechRepublic OLE Bypass Deep Dive 3
• SecurityWeek Exploitation Overview 4

---

📄 License

This project is provided strictly for research and educational purposes.