Microsoft Word CVE-2026-108426

Exploitation requires a user to open or preview a maliciously crafted Word document in an affected build of Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, or Microsoft Office LTSC 2024 - the required feature is Word's file-parsing path, and the required deployment mode is simply having Word installed. The key LIMITING factor is mandatory user interaction (UI:R): the attack cannot fire without the victim opening the attacker-supplied file, so it depends on social engineering (phishing attachment or malicious download) rather than fully automated remote triggering. Code executes in the context of the user who opens the document, so a non-administrative user limits the initial privilege level obtained. Protected View / Office hardening and the absence of macro reliance (this is a memory-corruption parser bug, not a macro) affect realistic risk.

This is a credible high-priority vulnerability, though not a drop-everything emergency on the available signals. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-reachable, unauthenticated, low-complexity code execution with full confidentiality/integrity/availability impact - the classic profile of a document-parsing remote code execution flaw in Office. The one meaningful brake is UI:R: a victim must open or preview a maliciously crafted Word document, so exploitation depends on social engineering rather than being wholly automatable. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or available exploit code at this time (no public exploit identified at time of analysis). Note the tension between signals: the CVSS vector marks AV:N/PR:N (network, unauthenticated), yet real-world triggering requires user interaction with a file typically delivered via email or web - this is standard for Office RCE and not a data conflict, but defenders should read 'network/unauthenticated' as 'attacker needs no account, but does need a user to open the file.' Given the ubiquity of Microsoft Office, the heap-overflow class (CWE-122, often leading to reliable RCE), and a vendor patch already available, this warrants prompt patching despite the absence of in-the-wild exploitation data.

An attacker emails a specially crafted Word document (or hosts it on a web page) to a target and lures them into opening it. When Word parses the malformed file, a heap-based buffer overflow is triggered, allowing the attacker to execute arbitrary code in the context of the user. No public exploit code was identified at the time of analysis, and exploitation hinges on the victim opening the attacker-supplied document.