Microsoft Word CVE-2026-108443

Exploitation requires the victim to open an attacker-crafted Word document (CVSS UI:R) in an affected build of Microsoft Office/Word - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the macOS variants (Office 365 for Mac, Office LTSC for Mac 2021/2024). No authentication or prior access to the target is needed (PR:N), and attack complexity is low (AC:L), but code runs only in the context of the user who opens the file (S:U), so the primary limiting factor is the mandatory user interaction. Preview-pane or protected-view mitigations may further constrain triggering depending on configuration, though the input does not confirm which Office features gate the parser path.

This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-deliverable, low-complexity, unauthenticated code-execution flaw whose only gating factor is user interaction (UI:R) - the victim must open a malicious Word document. The CWE-193 off-by-one error is a classic memory-corruption primitive consistent with document-parser RCE. However, the exploitation-signal picture is incomplete: no EPSS score, no KEV listing, and no POC were provided, so there is no evidence of active exploitation or public exploit code at this time. The 'network' attack vector is the standard Microsoft convention for malicious-document delivery (email/web) and should not be read as a remote, interaction-free service exploit - the UI:R requirement is the real-world brake on mass exploitation. Because the affected products (Microsoft Office / Word) are ubiquitous and a vendor patch already exists, this should be patched promptly despite the absence of exploitation telemetry; the combination of huge install base plus a weaponizable document format historically attracts phishing-driven exploitation even when no POC is initially public. Note one data inconsistency: the input Tags include 'Authentication Bypass,' which contradicts both the CWE (off-by-one memory error) and the description (code execution) - treat that tag as erroneous.

An attacker crafts a malicious Word document that triggers the off-by-one error in Word's parser and emails it to a target (e.g., as a phishing attachment or lure). When the victim opens the file, memory corruption leads to arbitrary code execution in the context of the user. No public exploit code was identified in the provided data, so this scenario is inferred from the CVSS vector and CWE rather than an observed POC.