EUVD-2026-102441Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Word document via email/link
-
DeliveryVictim opens malicious file
-
ExploitTrigger heap buffer overflow in Word parser
-
ExecutionExecute arbitrary code as user
-
ImpactCompromise host data and integrity
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted Word document in a vulnerable build (UI:R in the vector) - there is no automatic, interaction-free trigger. Affected deployments per CPE are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024; a vendor patch is available, so patched installations are not exposed. The attacker needs no credentials on the target (PR:N) and no prior access, but must achieve file delivery and user open action; Protected View / Mark-of-the-Web prompts and disabling content from untrusted sources materially limit real-world success. |
| Impact | This is a genuine priority for patching despite the absence of exploitation telemetry. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-deliverable, low-complexity, unauthenticated heap overflow in Microsoft Office Word with full confidentiality, integrity, and availability impact - the classic 'malicious document' RCE profile where the only barrier is user interaction (UI:R), i.e. the victim opening a crafted file. Mitigating signals: EPSS probability is NOT provided in the input, there is NO CISA KEV listing, and NO public proof-of-concept is referenced, so this is 'no public exploit identified at time of analysis' rather than active exploitation. The single confirming signals are that a vendor patch exists and Microsoft itself is the reporter. Conflict to note explicitly: the vector asserts PR:N (unauthenticated) and AV:N (network), but exploitation realistically requires the attacker to deliver a document and persuade a user to open it, so 'network, unauthenticated' overstates how automatic this is - treat it as attacker-crafted-file RCE, not a wormable remote service bug. EPSS being absent means widespread-exploitation likelihood cannot be quantified from this data. |
| Exploit ScenarioDerived | An attacker emails or otherwise delivers a specially crafted Word document to a target; when the victim opens it in a vulnerable Office/Word build, a heap-based buffer overflow (CWE-122) is triggered and arbitrary code executes in the context of the user. No authentication is required of the attacker, but the attack depends on the victim opening the file (UI:R). No public proof-of-concept is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Heap-based buffer overflow in Microsoft Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024) allows a remote, unauthenticated attacker to execute code in the context of the victim when a crafted document is opened, matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 High). Exploitation is not interaction-free: the vector's UI:R component and the assessed conditions require file delivery plus a user open action, so Protected View and Mark-of-the-Web prompts materially limit real-world success. No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available from Microsoft and this remains a genuine priority for patching.
RemediationAI
Vendor-released patch: apply the Microsoft security update referenced in the MSRC update guide for CVE-2026-108429 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108429); per the input data, patch availability is "Available from vendor" and the advisory should be consulted for the exact fixed build numbers for Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, since an exact version string was not provided here and must not be invented. Until patching completes, the assessed exploitation conditions show that the attack requires a victim to open a crafted Word document, so enforcing Protected View and keeping Mark-of-the-Web enabled for files from the internet or untrusted locations is a high-value compensating control, with the trade-off that users will see extra prompts and some document workflows will require explicit unblocking. Additionally, block or quarantine external email attachments and untrusted file shares that deliver Office documents, disable ActiveX/macro and embedded-object execution for untrusted content via Group Policy or the Trust Center, and consider disabling or restricting Word document handling for high-risk user groups; these controls may break legitimate line-of-business templates or automated document processing and should be scoped and tested before wide deployment. Because no public exploit code has been identified at time of analysis, these compensating controls are precautionary rather than a response to observed exploitation, and no KEV-driven emergency action is indicated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-122 heap-based buffer overflow in Microsoft Word's parsing of document content, a memory-safety class in which an out-of-bounds write to heap-allocated memory corrupts adjacent data and can be leveraged for arbitrary code execution. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a network-deliverable, low-complexity issue with no target credentials required and no scope change, but a required user interaction. Per the provided CPE data, the affected code ships in the Microsoft 365 Apps for Enterprise channel and the perpetual Office LTSC 2021 and Office LTSC 2024 builds, so exposure follows wherever those desktop builds are used to open Word documents. Because the trigger is a crafted document rather than a remotely reachable service, the practical attack chain depends on delivering the file to a victim and getting it opened; Microsoft's Protected View, Mark-of-the-Web, and disabled untrusted content controls are the primary friction points against that chain. A vendor patch is available, so the analysis does not indicate a defect that is unpatchable or only mitigable.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Document is network-delivered (AV:N) and needs no attacker auth (PR:N) but requires the victim to open it (UI:R); memory-corruption RCE yields full C/I/A in the user's context, scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Word, used across Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, contains a high-severity vulnerability that could allow an attacker to execute malicious code on a user's system when a crafted document is opened. This affects any organization using these widely deployed Office versions, potentially leading to unauthorized access to sensitive data or further network compromise. Leadership should prioritize patching to mitigate risk to productivity and data security.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
GitHub PoC
Exploit-DB