EUVD-2026-99063
GHSA-8hm3-32wh-cw6c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Word document to victim
-
DeliveryVictim opens malicious file
-
ExploitTrigger integer overflow in Word parser
-
ExecutionCorrupt memory and hijack execution
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a specially crafted Microsoft Word document that triggers the integer overflow (CWE-190) during file parsing - this is the concrete precondition implied by UI:R in the vector. No authentication or prior privileges are needed (PR:N), and the vector is network-deliverable (AV:N, e.g. emailing or hosting the malicious file). Limiting factors that reduce realistic risk: mandatory user interaction (the target must actually open the document), high attack complexity (AC:H, indicating the integer overflow requires specific conditions to reliably achieve code execution), and scope is unchanged so impact is confined to the context of the user running Word. |
| Impact | This is a moderately high but not top-tier priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5) describes a network-delivered remote code execution flaw requiring no privileges but DEPENDING on user interaction (UI:R) and carrying high attack complexity (AC:H) - meaning the attacker must get a victim to open a crafted file AND win non-trivial exploitation conditions (typical for CWE-190 integer overflows that require precise memory/heap state). The high complexity and mandatory user interaction are what hold this at 7.5 rather than ~9.x despite full C/I/A compromise. EPSS probability is NOT provided, KEV status is NOT listed (no confirmed active exploitation), and no POC is referenced, so all three dynamic exploitation signals are absent - this is a disclosure-stage rating driven purely by the CVSS vector. There is no SSVC decision data provided. No signals conflict, but the complete absence of EPSS/KEV/POC means real-world exploitation pressure cannot be confirmed from the input and should be treated as unknown rather than assumed low. |
| Exploit ScenarioDerived | An attacker crafts a malicious Word document that triggers an integer overflow during parsing and delivers it via email or a download link. When the targeted user opens the document, the overflow corrupts memory and leads to arbitrary code execution in the context of the user. No public exploit code is referenced, and the high attack complexity means reliable exploitation is non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Integer overflow (CWE-190) in Microsoft Word's document parsing can allow an unauthenticated, network-delivered attacker to execute code in the context of the victim by convincing them to open a specially crafted Word document. Exploitation requires user interaction (UI:R) and high attack complexity (AC:H), and impact is confined to the user's Word process (scope unchanged). No public exploit identified at time of analysis, making this a moderately high but not top-tier priority for most organizations.
RemediationAI
Apply the security update provided by Microsoft through the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105715); the advisory lists the exact patched versions, which are not specified in this data set. If immediate patching is not possible, enforce Protected View for documents originating from the internet and disable the ability for users to enable editing without additional prompts (trade-off: reduced usability). Consider Microsoft Defender Application Guard for Office to open untrusted documents in an isolated container (trade-off: may break add-ins and slow document opening). Attack Surface Reduction rules such as 'Block Office applications from creating executable content' and 'Block Office applications from injecting code into other processes' can contain post-exploitation activity, though they may disrupt legitimate macros and add-ins. Run Word with least user privileges and educate users not to open unsolicited attachments. No public exploit identified at time of analysis, so targeted attacks are less likely, but the above measures reduce risk until patching is complete.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an integer overflow or wraparound (CWE-190) in the way Microsoft Word parses document structures. When Word processes a crafted file, an arithmetic operation on a size or length value exceeds the integer's representable range, causing it to wrap. This can bypass expected bounds checks and lead to a buffer overflow (as indicated by the 'Buffer Overflow' tag), corrupting memory and enabling arbitrary code execution within the Word process. The CVSS vector shows AV:N (network-deliverable, e.g., via email or web download), AC:H (specific conditions must align to reliably trigger the overflow), PR:N (no authentication needed), UI:R (the victim must open the document), and S:U (impact is confined to the Word process, not the entire system). No CPE strings were provided, but the affected technology is Microsoft Office Word, and the root cause class is memory corruption through unsafe integer arithmetic in parsing.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
File is delivered over a network (AV:N) with no auth (PR:N) but the victim must open it (UI:R) and integer-overflow exploitation needs specific memory conditions (AC:H), yielding full code-execution impact (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Word users are at risk from a high-severity vulnerability (CVE-2026-105715) that could allow an attacker to execute code on their systems when they open a malicious document. No public exploit identified at time of analysis, and exploitation requires user interaction with high complexity. However, with no vendor-released patch available, organizations must implement interim mitigations to protect sensitive data and maintain business continuity.
Enable Protected View for all Word documents from untrusted sources, configure Microsoft Defender Application Guard for Office, block macros from the internet, implement email filtering and attachment sandboxing, restrict user privileges, provide user awareness training, and consider application whitelisting and network segmentation to limit the impact of a successful exploit.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB