Microsoft Word CVE-2026-108438

Exploitation requires an affected Office build (Microsoft 365 Apps for Enterprise, Office 365 for Mac, or Office LTSC for Mac 2021/2024) and, per UI:R in the CVSS vector, requires the targeted user to actively open or preview a maliciously crafted Word document delivered over the network (e.g., email attachment or download). No authentication is required (PR:N), and default configurations are sufficient - there is no special feature or non-default setting named in the description. The primary limiting factor is the mandatory user interaction, which blocks unattended/automated exploitation; impact is limited to confidentiality (memory/information disclosure) with no code execution, integrity, or availability effect implied by the vector.

This is a moderate-priority information-disclosure flaw, not a critical one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity, unauthenticated issue whose impact is confined to high confidentiality loss with no integrity or availability impact - consistent with the description's 'disclose information' wording (a classic memory-disclosure use-after-free that leaks heap contents rather than achieving code execution). The decisive limiter is UI:R: a user must open or preview a crafted Word document, so exploitation is not automatable at scale and depends on social engineering. No EPSS score, SSVC decision, KEV listing, or POC was provided, so there is no evidence of active exploitation or public exploit code; exploitation probability signals are simply absent rather than low. Note a conflict in the metadata: the tags include 'Denial Of Service,' but the CVSS vector explicitly sets A:N (no availability impact) and the description is purely about information disclosure - the DoS tag appears mislabeled and should not drive prioritization. Net: treat as a routine Patch-Tuesday-class confidentiality bug in ubiquitous software - patch promptly given footprint, but it is not a drop-everything emergency absent exploitation signals.

An attacker emails or hosts a specially crafted Word document and lures a victim into opening it in an affected Office build. Opening the file triggers a use-after-free whose freed/reallocated memory is reflected back, leaking sensitive heap contents (e.g., memory that may contain other document data or process information) to the attacker. No public exploit code was identified at time of analysis, and the attack requires the victim to open the file (UI:R).