EUVD-2026-102439Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Word document via email/web
-
DeliveryVictim opens malicious file
-
ExploitTrigger heap buffer overflow in parser
-
ExecutionExecute arbitrary code as user
-
ImpactCompromise host and data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open or preview a specially crafted Word document in an affected product (Microsoft 365 Apps for Enterprise, Office LTSC 2021, or Office LTSC 2024); per PR:N the attacker needs no prior authentication, but per UI:R the attack cannot succeed without that user interaction. This user-interaction requirement is the primary limiting factor - there is no automatic/zero-click or server-side trigger evident in the data - so Protected View, blocking Office documents from untrusted sources, and user awareness materially reduce realistic risk. No special non-default product configuration is indicated as a prerequisite. |
| Impact | This is a genuine high-priority vulnerability, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-deliverable, low-complexity, unauthenticated heap overflow (CWE-122) yielding full C:H/I:H/A:H impact - the classic profile of a weaponizable Office file-format RCE delivered via email or web download. The single limiting factor is UI:R: a user must open or preview a crafted Word document, which lowers the practical likelihood versus a zero-click flaw. No EPSS score, KEV listing, or POC indicator was provided in the input, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis; this tempers the urgency relative to an actively-exploited bug. Note the standard tension in Office file-format CVEs: Microsoft rates these AV:N because the malicious document is delivered over a network, yet actual code execution occurs locally when the victim opens the file - the AV:N/UI:R combination reflects that delivery-vs-trigger distinction rather than a true remote service exposure. Given Microsoft Office's enormous install base and vendor-confirmed patch availability, this warrants prompt patching, but the UI:R requirement and absence of confirmed in-the-wild exploitation place it below drive-by/wormable network flaws in priority. |
| Exploit ScenarioDerived | An attacker emails a crafted Word document (or hosts it for download) to a target and uses social engineering to induce the victim to open it. Parsing the malformed structure triggers a heap-based buffer overflow in Word, allowing arbitrary code execution in the user's security context. No public exploit code was identified in the provided data, and successful attack depends on the victim opening the file (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Heap-based memory corruption in Microsoft Word - affecting Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 - lets a remote, unauthenticated attacker execute arbitrary code in the context of the victim, but only when that victim opens or previews a specially crafted Word document. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms the trigger is entirely dependent on user interaction, so there is no zero-click or server-side path; no public exploit code or confirmed active exploitation has been identified at time of analysis, and a vendor patch is available. That combination - high technical severity but a required user action and an available fix - makes this a high-priority vulnerability rather than an emergency.
RemediationAI
Apply the Microsoft security update for CVE-2026-108427 through the Microsoft Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108427); patch status is "Available from vendor," so no exact fixed build number was supplied in the source data and administrators should take the current build published in that advisory for each channel (Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024) rather than assume a version. Until patching completes, the most effective compensating control is keeping Protected View enabled for files originating from the Internet and other untrusted locations (it opens documents in a sandboxed, read-only mode that blocks the parsing path that leads to exploitation; the trade-off is that users must click "Enable Editing" for legitimate external documents). Additionally, block or quarantine Word documents received from untrusted senders or downloaded from the web at the email gateway/proxy, and configure Office Trust Center file-block settings to refuse legacy formats the business does not need - accepting that this can disrupt workflows involving older .doc files. Restricting macro and ActiveX execution and disabling document preview handlers in Explorer/Outlook reduce additional attack surface but do not eliminate the core parsing flaw; the vendor patch remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a heap-based buffer overflow (CWE-122), meaning a length, size, or count value derived from attacker-controlled document content is used to allocate or bound a heap buffer in Word's parsing/rendering path, and subsequent writes exceed that buffer. Because the overflow occurs on the heap, it can corrupt adjacent objects and function pointers, giving an attacker a route to controlled memory corruption and code execution in the Word process (which runs with the privileges of the logged-in user, and therefore can be chained with OS-level persistence or privilege escalation). The affected software identified by CPE is Microsoft 365 Apps for Enterprise and the perpetually-licensed Microsoft Office LTSC 2021 and Office LTSC 2024 channels; CPE entries use wildcard version ranges, so all builds predating the corresponding Microsoft security update should be treated as affected. Typical exploitation tradecraft for this class of bug combines heap grooming through repeated file-open/content-manipulation sequences with mitigation bypasses for ASLR/DEP, and delivery is normally via email attachment, web download, or a hosted file that the victim is persuaded to open. Microsoft published the fix through its Update Guide (msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108427), and the affected code is in the client application rather than in a remote service, which is why the surrounding controls (Protected View, file-type blocking, macro and ActiveX restrictions) are effective risk reducers.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious document is network-delivered (AV:N) with no auth (PR:N) but requires the victim to open it (UI:R); memory-corruption RCE in the user context yields full C/I/A.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity memory corruption flaw in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, allowing an unauthenticated attacker to run arbitrary code on an endpoint whenever a user opens or previews a malicious document. Because the trigger is a routine user action - opening a file - the exposure spans nearly every knowledge worker in the organization, and successful exploitation would give an attacker the same rights as the victim on that machine. A vendor patch is available, so leadership should treat this as a scheduled, high-priority remediation rather than an emergency, provided it is closed out promptly.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
GitHub PoC
Exploit-DB