Reliance on untrusted inputs in a security decision in Microsoft Office

# Test-CVE-2026-21509.ps1

# Checks Microsoft Office exposure for CVE-2026-21509

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


[CmdletBinding()]
param()

$ErrorActionPreference = 'SilentlyContinue'

function Parse-Version($s) {
    try { return [version]$s } catch { return $null }
}

function Get-FileVersion($path) {
    if (Test-Path $path) {
        try { return [version](Get-Item $path).VersionInfo.FileVersion } catch { return $null }
    }
    return $null
}

function Test-KillBit {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Office\Common\COM Compatibility\{EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B}',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Office\Common\COM Compatibility\{EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B}'
    )
    foreach ($p in $paths) {
        $v = Get-ItemProperty -Path $p -Name 'Compatibility Flags'
        if ($null -ne $v) {
            $flags = [int64]$v.'Compatibility Flags'
            if (($flags -band 0x400) -eq 0x400) { return $true }
        }
    }
    return $false
}

$fixed2016 = [version]'16.0.5539.1001'
$fixed2019 = [version]'16.0.10417.20095'
$killBit = Test-KillBit

$findings = @()
$unknowns = @()
$servicedProtected = $false

# Click-to-Run detection

$c2r = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration'
if ($c2r) {
    $productIds = @()
    if ($c2r.ProductReleaseIds) { $productIds = ($c2r.ProductReleaseIds -split ',') }
    $platform = $c2r.Platform
    $ver = Parse-Version $c2r.VersionToReport

    $is2016 = ($productIds | Where-Object { $_ -match '2016' }).Count -gt 0
    $is2019 = ($productIds | Where-Object { $_ -match '2019' }).Count -gt 0
    $isServiced = ($productIds | Where-Object { $_ -match 'O365|2021|2024|LTSC2021|LTSC2024' }).Count -gt 0

    if ($isServiced) { $servicedProtected = $true }

    if ($is2016 -and $ver) {
        $findings += [pscustomobject]@{ Product='Office 2016 C2R'; Version=$ver; Vulnerable=($ver -lt $fixed2016) }
    }
    if ($is2019 -and $ver) {
        $findings += [pscustomobject]@{ Product='Office 2019 C2R'; Version=$ver; Vulnerable=($ver -lt $fixed2019) }
    }
    if (-not $is2016 -and -not $is2019 -and -not $isServiced) {
        $unknowns += 'Click-to-Run Office detected but release channel could not be mapped confidently.'
    }
}

# Uninstall inventory fallback

$uninstallRoots = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$apps = foreach ($root in $uninstallRoots) {
    Get-ItemProperty $root | Where-Object { $_.DisplayName -match 'Microsoft Office' }
}

foreach ($app in $apps) {
    $name = [string]$app.DisplayName
    $dispVer = Parse-Version $app.DisplayVersion
    if ($name -match '2016' -and $dispVer) {
        $findings += [pscustomobject]@{ Product=$name; Version=$dispVer; Vulnerable=($dispVer -lt $fixed2016) }
    } elseif ($name -match '2019' -and $dispVer) {
        $findings += [pscustomobject]@{ Product=$name; Version=$dispVer; Vulnerable=($dispVer -lt $fixed2019) }
    } elseif ($name -match '2021|2024|Microsoft 365|365 Apps') {
        $servicedProtected = $true
    }
}

# InstallRoot fallback using WinWord version

$installRoots = @(
    'HKLM:\SOFTWARE\Microsoft\Office\16.0\Word\InstallRoot',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Word\InstallRoot'
)
foreach ($ir in $installRoots) {
    $root = (Get-ItemProperty $ir).Path
    if ($root) {
        $exe = Join-Path $root 'WINWORD.EXE'
        $fv = Get-FileVersion $exe
        if ($fv) {
            if (($fv.Build -ge 10417) -or ($fv.Build -ge 5539 -and $fv.Build -lt 10417)) {
                $unknowns += "Found WINWORD.EXE $fv at $exe, but edition mapping (2016 vs 2019) is ambiguous without better inventory."
            }
        }
    }
}

# Deduplicate findings

$findings = $findings | Sort-Object Product, Version -Unique

if ($findings.Count -gt 0) {
    $vuln = $findings | Where-Object { $_.Vulnerable -eq $true }
    if ($vuln.Count -gt 0) {
        if ($killBit) {
            Write-Output 'VULNERABLE'
            Write-Output 'Reason: Vulnerable Office 2016/2019 build detected, but temporary COM kill-bit mitigation is present.'
            $vuln | ForEach-Object { Write-Output ("Detected: {0} {1}" -f $_.Product, $_.Version) }
            exit 1
        } else {
            Write-Output 'VULNERABLE'
            Write-Output 'Reason: Vulnerable Office 2016/2019 build detected and COM kill-bit mitigation is absent.'
            $vuln | ForEach-Object { Write-Output ("Detected: {0} {1}" -f $_.Product, $_.Version) }
            exit 1
        }
    } else {
        Write-Output 'PATCHED'
        $findings | ForEach-Object { Write-Output ("Detected: {0} {1}" -f $_.Product, $_.Version) }
        if ($killBit) { Write-Output 'Note: COM kill-bit mitigation also present.' }
        exit 0
    }
}

if ($servicedProtected -and -not $findings.Count) {
    Write-Output 'PATCHED'
    Write-Output 'Reason: Only Microsoft 365 Apps / Office 2021+ style inventory was detected; vendor reporting indicates service-side protection after Office restart.'
    if ($killBit) { Write-Output 'Note: COM kill-bit mitigation also present.' }
    exit 0
}

if ($unknowns.Count -gt 0) {
    Write-Output 'UNKNOWN'
    $unknowns | ForEach-Object { Write-Output $_ }
    exit 2
}

Write-Output 'UNKNOWN'
Write-Output 'Reason: No conclusive Office 2016/2019 inventory found, or product mapping could not be determined.'
exit 2