Microsoft Office Word CVE-2026-108433

Exploitation requires the victim to locally open or preview an attacker-crafted Office/Word document (CVSS UI:R, AV:L) - there is no remote, un-prompted network vector. No attacker authentication or privileges are needed (PR:N). The core prerequisite is that the attacker controls an input that Office consumes when making a security decision (CWE-807), allowing a security feature such as Protected View, mark-of-the-web enforcement, or a trust/macro prompt to be bypassed. Limiting factors that reduce real-world risk: the mandatory user interaction (opening the file), local attack vector (no drive-by over the network without delivery), and the fact that the affected product must be one of the listed Office/Microsoft 365 Apps or Office LTSC builds (Windows or Mac) at a pre-patch version.

The input CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 7.8 (High) and describes a locally-exploitable security-feature bypass in Microsoft Office Word rooted in CWE-807 (reliance on untrusted inputs in a security decision). The signals are internally consistent: AV:L combined with UI:R indicates the attacker does not reach the target over a network but instead relies on a victim opening or processing an attacker-supplied document on the local machine, while PR:N confirms no prior authentication or privileges are needed on the part of the attacker. High C/I/A impacts suggest that bypassing the security feature (likely a Protected View / mark-of-the-web / macro or trust decision) exposes the host to further compromise. On the threat-intelligence side the picture is comparatively low-urgency: there is no CISA KEV listing, no EPSS score was supplied in the input, and no public exploit was referenced, so there is no public exploit identified at time of analysis. The only reference is the vendor MSRC advisory, and a patch is available. Net assessment: this is a credible, broadly-relevant patch-priority item because of the ubiquity of Office and the no-privilege/no-network-auth nature of the bug, but it is NOT a confirmed actively-exploited emergency - the absence of KEV and any POC means risk is currently theoretical and user-interaction-gated rather than wormable. Note the conflicting framing worth verifying: the CVE Description names 'Microsoft Office Word' specifically, yet the CPE list enumerates broader Office/Microsoft 365 Apps and Office LTSC (Windows and Mac) packages - confirm with the MSRC advisory whether the flaw is Word-specific or affects the shared Office codebase. EPSS data is absent, so no exploitation-probability comparison could be made.

An attacker crafts a malicious Word document that abuses an untrusted input used in a security decision, then delivers it via email, chat, or a download so the victim opens it locally. Because the flawed security check can be bypassed, a protection such as Protected View or a trust/warning prompt fails to block the content, leading to high-impact compromise on the victim's host. No public exploit code is identified at time of analysis, and successful exploitation requires the victim to open the file (UI:R).