EUVD-2026-102449Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Word document via phishing
-
DeliveryVictim opens file in Word
-
ExploitTrigger heap buffer overflow in parser
-
ExecutionExecute arbitrary code as user
-
ImpactEstablish foothold on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-crafted Word document in a vulnerable build of Microsoft Office Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021, or Office LTSC 2024); the heap overflow is triggered during document parsing. The key LIMITING factor is mandatory user interaction (CVSS UI:R) - the attack cannot fire without the user opening the file, and Protected View / Mark-of-the-Web sandboxing or disabled content can blunt or block the chain. No authentication or special privileges are required of the attacker (PR:N), and the flaw executes code only in the context of the opening user rather than elevating automatically (S:U). |
| Impact | This is a genuine high-priority vulnerability, though not a drop-everything emergency based on currently available signals. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates a network-exploitable, low-complexity flaw needing no privileges but requiring user interaction (UI:R) - consistent with the classic weaponized-document attack pattern against Microsoft Office Word. SSVC-style reasoning: technical impact is total (C:H/I:H/A:H = arbitrary code execution), but exploitation is NOT automatable because a human must open the malicious file, which materially lowers the propagation speed versus a wormable zero-click bug. No EPSS score, no CISA KEV listing, and no POC indicator were provided, so there is no evidence of active exploitation or public exploit code at this time. The signals are internally consistent (no CVSS-vs-description conflict), but exploitation-probability data (EPSS) is MISSING, so the 'likelihood' dimension cannot be quantified - the priority rests on the combination of total impact, ubiquitous deployment, and the historically high attacker interest in Office document RCE, not on confirmed exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malicious Word document that triggers a heap-based buffer overflow (CWE-122) and delivers it via phishing email, a shared link, or a compromised website. When the victim opens the document in a vulnerable Office/Word build, the overflow corrupts heap memory and executes attacker-controlled code in the context of the user. No public exploit code was identified at time of analysis, and successful exploitation depends on the user actually opening the file (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Heap-based buffer overflow in Microsoft Office Word allows unauthenticated remote attackers to execute code on vulnerable systems when a user opens a crafted document, affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024. The attack requires user interaction (opening a malicious file) and executes code in the context of the opening user without privilege escalation, resulting in a CVSS score of 8.8. No public exploit code or active exploitation has been identified, and a vendor patch is available; this is a high-priority vulnerability but not an emergency based on current signals.
RemediationAI
Apply the vendor-released patch as described in the Microsoft Security Response Center advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108437); patch availability is confirmed but exact version numbers are not provided in the input data. As a compensating control, ensure Protected View is enabled for documents originating from the internet or other untrusted locations, which can prevent the malicious document from being parsed; this may impact user workflow by requiring manual enablement of editing. Additionally, educate users not to open unexpected attachments without verifying their source, and consider blocking hazardous file types (e.g., .doc, .docx) at email gateways, though this may disrupt legitimate business communications. Note that disabling macros does not mitigate this vulnerability as it is triggered during document parsing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft Office Word's document parsing engine. When Word processes a specially crafted document, it writes more data to a heap-allocated buffer than intended, corrupting adjacent memory. This can lead to arbitrary code execution. The affected products, as indicated by CPEs, are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. The flaw requires user interaction to trigger, as the malicious document must be opened, and it runs in the security context of the user, not elevated. Microsoft's Protected View and Mark-of-the-Web mechanisms can mitigate the attack by preventing the document from being fully parsed, but they are not foolproof and may be bypassed if the user disables them.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious document is delivered over the network (AV:N) and reliably parsed (AC:L) with no attacker privileges (PR:N), but the victim must open it (UI:R), yielding full code execution in-process (C/I/A:H, S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A heap-based buffer overflow in Microsoft Word - affecting Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 - allows an attacker to execute code on a workstation when a user opens a crafted document, running with the permissions of that user. Because Word is installed on virtually every knowledge-worker desktop and documents are routinely exchanged with external parties, a single malicious file could compromise an endpoint and provide a foothold inside the network. No public exploit code has been identified at time of analysis and a vendor patch is available, so this should be managed as a high-priority patch campaign rather than an emergency response.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
GitHub PoC
Exploit-DB