CVE-2026-21509 — Microsoft Office Security Feature Bypass

• CVE-2026-21509 is a Microsoft Office security feature bypass vulnerability
• CVSS 7.8, actively exploited by APT28 (Russian hackers) against Ukraine
• Reliance on untrusted inputs in security decisions (CWE-807) — "breaking the kill bit"
• Allows bypass of Protected View and OLE mitigations via malicious documents
• Affects Office 2016, 2019, 2021, 2024, Microsoft 365 Apps
• Emergency out-of-band patch issued January 2026

---

Overview

CVE-2026-21509 is a security feature bypass vulnerability in Microsoft Office that allows an attacker to circumvent Protected View and OLE (Object Linking and Embedding) mitigations. The flaw is rooted in how Office validates the kill bit — a registry mechanism designed to block dangerous CLSIDs. By supplying a crafted OLE object with an altered CLSID or by manipulating the activation context, an attacker can trick Office into trusting an embedded control that should have been blocked.

---

Technical Details

Root Cause: CWE-807 — Reliance on Untrusted Inputs in a Security Decision. The kill-bit check on COM/OLE objects uses data that an attacker can influence through document-level overrides. Specifically, the IDataObject or IOleObject implementation in certain Office documents can redirect the kill-bit lookup to an attacker-controlled registry path, or supply a GUID that bypasses the blocklist entirely.

Attack Vector:

1. A crafted RTF or DOCX file embeds a malicious OLE object (e.g. a shell-execution COM control).
2. When opened, Office queries the kill-bit registry before activating the OLE object.
3. The document supplies a spoofed CLSID or subverts the query via an OLE verb/datapath entry that points to a non-standard registry location.
4. The kill bit is not found at the expected path, so Office launches the control without restriction.
5. The control executes attacker-supplied code (e.g. MSHTA, PowerShell, or a script engine).

---

Affected Versions

---

Reproduction Steps

1. Install an affected version of Microsoft Office (see table above) on a Windows 10/11 x64 test environment.
2. Generate a malicious document using the provided exploit.py:
   root@kitploit:~

   python exploit.py --output malicious.doc --payload "calc.exe"
   

3. Open the generated file in Office. Protected View should be bypassed and the payload will execute.
4. After the patch is applied, the same file should be blocked — confirming the fix.

---

Proof of Concept

The exploit.py script in this repository generates a crafted RTF/DOC file that:

• Embeds an OLE object whose CLSID is set to {0002DF01-0000-0000-C000-000000000046} (DHTML Edit Control — a commonly weaponised control).
• Manipulates the \objdata and \object groups in the RTF to bypass the kill-bit lookup during activation.
• Optionally bundles a script payload (PowerShell or MSHTA) that runs on activation.

⚠ WARNING: This PoC is provided exclusively for authorised security testing. Do not deploy against systems you do not own or have explicit permission to test.

---

Mitigation

• Install the January 2026 out-of-band update — this is the only complete fix.
• Review and enforce the augmented kill-bit list provided in KB5002711.
• Enable Attack Surface Reduction (ASR) rules for Office child-process creation.
• Consider using Microsoft Defender for Office 365 to block known exploit documents.
• Restrict OLE object activation via Group Policy: `Computer Configuration > Administrative Templates > Microsoft Office

  Security Settings > Disable OLE Activation`.

---

References

• CVE-2026-21509 — MITRE
• CWE-807: Reliance on Untrusted Inputs
• Microsoft Security Response Center — January 2026 OOB Release
• APT28 / Fancy Bear — Activity Overview