Microsoft Word CVE-2026-108435

Exploitation requires the victim to open an attacker-crafted Microsoft Office Word document (UI:R) - this is the key limiting factor and makes the attack dependent on social engineering or phishing delivery rather than fully automatic remote exploitation. No authentication is required of the attacker (PR:N) and no special non-default Office configuration is indicated; the flaw affects default handling of documents in the listed Office/365/LTSC products, including macOS builds. The attack is confined to the vulnerable process (S:U) and yields only information disclosure, so it does not grant code execution, data modification, or denial of service, which further bounds realistic impact.

This is a moderate-severity information disclosure flaw (CVSS 6.5) with a coherent, internally consistent signal set. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a network-delivered, low-complexity, unauthenticated attack that nonetheless requires user interaction (UI:R) and yields only confidentiality impact (C:H, I:N, A:N) with no scope change - a profile fully consistent with the description of an untrusted pointer dereference (CWE-822) in Microsoft Office Word that leaks information when a victim opens attacker-controlled content. No EPSS score, KEV listing, or POC indicator was provided in the input, so exploitation likelihood cannot be quantified; there is no public exploit identified at time of analysis and it is NOT on CISA KEV. The practical risk is tempered by the mandatory user interaction (victim must open a malicious document) and the information-disclosure-only impact - this is not remote code execution and cannot alter or deny data. Weighed against the ubiquity of Office, the realistic priority is medium: patch in the normal cycle, prioritizing high-value or phishing-targeted users, rather than treating it as an emergency. No signals are conflicting; the main missing data is exploitation probability (EPSS) and any SSVC decision inputs, so a precise automatability/urgency determination cannot be made from the provided data alone.

An attacker emails or otherwise delivers a specially crafted Word document to a target and uses social engineering to induce them to open it. When opened, the malformed structure triggers an untrusted pointer dereference that reads memory the attacker should not have access to, disclosing sensitive in-process information (e.g., memory contents that may include other data or pointers). No public exploit code is identified at time of analysis, and the attack cannot succeed without the victim opening the file (UI:R).