Microsoft Word CVE-2026-108431

Exploitation requires the attacker to deliver a maliciously crafted Word document and the victim to open (or preview) it in an affected Microsoft Office Word build - this user-interaction requirement (UI:R) is the primary limiting factor, as the flaw cannot be triggered without a user action. No special non-default configuration is needed: default installations of the listed products (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, and Office 365 for Mac) are affected. The attacker needs no prior authentication or privileges on the target (PR:N), and code executes with the privileges of the user who opens the document, so a lower-privileged user account limits blast radius. Protected View / Mark-of-the-Web blocking and disabling document preview reduce practical exploitability.

This is a genuine high-priority vulnerability, though not a drop-everything emergency based on current signals. The CVSS vector (AV:N/AC:L/PR:N/UI:R) describes the classic 'malicious document' remote code execution pattern: network-deliverable, low complexity, no privileges needed, but requiring user interaction (opening or previewing a crafted Word file). Impact is total on the victim host (C:H/I:H/A:H), consistent with CWE-121 stack-based buffer overflow leading to arbitrary code execution in the user's security context. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code was indicated, so this is no public exploit identified at time of analysis - meaning risk is currently driven by potential rather than observed exploitation. The one true mitigating factor is UI:R: exploitation depends on social engineering the target into opening a weaponized document, which lowers real-world automatability relative to a zero-click flaw. Conflicting/missing data to note: EPSS and SSVC data are absent, so prioritization must rely on CVSS plus the near-universal footprint of the affected product. The combination of ubiquitous deployment, trivial attack complexity, and full-impact RCE makes this a strong patch-now candidate despite the lack of a confirmed exploit.

An attacker emails or otherwise delivers a specially crafted Word document (e.g., a .doc/.docx or RTF) to a target and lures them into opening it. Parsing the malicious file triggers a stack-based buffer overflow in Word, allowing arbitrary code execution in the context of the current user. No authentication is required of the attacker, but the victim must open the file; no public proof-of-concept was identified at the time of analysis.