Microsoft Word CVE-2026-108436

Exploitation requires the victim to open an attacker-crafted Word document in an affected Office/Word build (UI:R in the CVSS vector) - it is not a wormable, zero-click, or server-side flaw. No authentication or special privileges are needed on the target (PR:N), and default configurations are vulnerable, but the attack is limited by the need for user interaction and successful social engineering to deliver and open the malicious file. Impact is confined to disclosure of process memory (C:H, I:N, A:N); it does not by itself yield code execution or persistence.

This is a moderate-severity information disclosure flaw (CVSS 6.5) driven by an out-of-bounds read (CWE-125) in Microsoft Office Word. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N indicates network-reachable, low-complexity, unauthenticated exploitation but is gated by required user interaction (UI:R) - the victim must open a crafted document. Impact is confidentiality-only (C:H, I:N, A:N): the bug leaks memory contents, it does not grant code execution or data tampering. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is real but secondary to RCE-class Office bugs: the UI:R requirement means it depends on social engineering, and the confidentiality-only impact (memory disclosure, potentially useful for ASLR bypass chained with other bugs) limits standalone severity. Note: AV:N is standard Microsoft convention for file-delivered Office attacks even though delivery is typically via email/download rather than a live network protocol - the 'network' label reflects remote delivery, not a listening service, so defenders should treat this as a document-borne threat.

An attacker emails or hosts a specially crafted Word document and lures a victim into opening it. When Word parses the malformed structure, an out-of-bounds read exposes adjacent process memory, which is exfiltrated back to the attacker (e.g., via embedded remote content or a chained leak). No public exploit code was identified in the provided data, and success depends on the user opening the file.