CVE-2026-21509 — Microsoft Office Security Feature Bypass
CVE-2026-21509 is a Microsoft Office security feature bypass vulnerability
CVSS 7.8, actively exploited by APT28 (Russian hackers) against Ukraine
Reliance on untrusted inputs in security decisions (CWE-807) — "breaking the kill bit"
Allows bypass of Protected View and OLE mitigations via malicious documents
Affects Office 2016, 2019, 2021, 2024, Microsoft 365 Apps
Emergency out-of-band patch issued January 2026
Overview
CVE-2026-21509 is a security feature bypass vulnerability in Microsoft Office that
allows an attacker to circumvent Protected View and OLE (Object Linking and
Embedding) mitigations. The flaw is rooted in how Office validates the kill bit —
a registry mechanism designed to block dangerous CLSIDs. By supplying a crafted
OLE object with an altered CLSID or by manipulating the activation context, an
attacker can trick Office into trusting an embedded control that should have been
blocked.
Technical Details
Root Cause: CWE-807 — Reliance on Untrusted Inputs in a Security Decision.
The kill-bit check on COM/OLE objects uses data that an attacker can influence
through document-level overrides. Specifically, the IDataObject or
IOleObject implementation in certain Office documents can redirect the kill-bit
lookup to an attacker-controlled registry path, or supply a GUID that bypasses
the blocklist entirely.
Attack Vector:
A crafted RTF or DOCX file embeds a malicious OLE object (e.g. a
shell-execution COM control).
When opened, Office queries the kill-bit registry before activating the OLE
object.
The document supplies a spoofed CLSID or subverts the query via an OLE
verb/datapath entry that points to a non-standard registry location.
The kill bit is not found at the expected path, so Office launches the
control without restriction.
The control executes attacker-supplied code (e.g. MSHTA, PowerShell, or a
script engine).
Affected Versions
Product
Version / Build
Office 2016
All versions prior to KB5002711
Office 2019
All versions prior to KB5002712
Office 2021
All versions prior to KB5002713
Office 2024
All versions prior to KB5002714
Microsoft 365 Apps
Build prior to 2501 (January 2026)
Reproduction Steps
Install an affected version of Microsoft Office (see table above) on a
Windows 10/11 x64 test environment.
Generate a malicious document using the provided exploit.py:
Open the generated file in Office. Protected View should be bypassed
and the payload will execute.
After the patch is applied, the same file should be blocked —
confirming the fix.
Proof of Concept
The exploit.py script in this repository generates a crafted RTF/DOC file that:
Embeds an OLE object whose CLSID is set to {0002DF01-0000-0000-C000-000000000046} (DHTML Edit Control — a commonly weaponised control).
Manipulates the \objdata and \object groups in the RTF to bypass
the kill-bit lookup during activation.
Optionally bundles a script payload (PowerShell or MSHTA) that runs on
activation.
⚠ WARNING: This PoC is provided exclusively for authorised security testing.
Do not deploy against systems you do not own or have explicit permission to test.
Mitigation
Install the January 2026 out-of-band update — this is the only complete fix.
Review and enforce the augmented kill-bit list provided in KB5002711.
Enable Attack Surface Reduction (ASR) rules for Office child-process
creation.
Consider using Microsoft Defender for Office 365 to block known exploit
documents.
Restrict OLE object activation via Group Policy:
`Computer Configuration > Administrative Templates > Microsoft Office
