## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-RAZUREINK-CVE-2026-21509-OFFICE_SECURITY_BYPASS_REPRODUCTION
# CVE-2026-21509 — Microsoft Office Security Feature Bypass
* **CVE-2026-21509** is a Microsoft Office security feature bypass vulnerability
* **CVSS 7.8** , actively exploited by **APT28 (Russian hackers)** against Ukraine
* Reliance on untrusted inputs in security decisions (**CWE-807**) — "breaking the kill bit"
* Allows bypass of **Protected View** and **OLE mitigations** via malicious documents
* Affects **Office 2016, 2019, 2021, 2024, Microsoft 365 Apps**
* Emergency out-of-band patch issued **January 2026**
* * *
## Overview
CVE-2026-21509 is a security feature bypass vulnerability in Microsoft Office that allows an attacker to circumvent Protected View and OLE (Object Linking and Embedding) mitigations. The flaw is rooted in how Office validates the kill bit — a registry mechanism designed to block dangerous CLSIDs. By supplying a crafted OLE object with an altered CLSID or by manipulating the activation context, an attacker can trick Office into trusting an embedded control that should have been blocked.
* * *
## Technical Details
**Root Cause:** CWE-807 — Reliance on Untrusted Inputs in a Security Decision. The kill-bit check on COM/OLE objects uses data that an attacker can influence through document-level overrides. Specifically, the IDataObject or IOleObject implementation in certain Office documents can redirect the kill-bit lookup to an attacker-controlled registry path, or supply a GUID that bypasses the blocklist entirely.
**Attack Vector:**
1. A crafted RTF or DOCX file embeds a malicious OLE object (e.g. a shell-execution COM control).