Microsoft Office CVE-2026-108444

Exploitation requires the victim to open an attacker-crafted Office document (UI:R in the vector), so it is not zero-click; delivery is typically via phishing attachment or malicious download. No authentication or prior access is needed (PR:N), and attack complexity is low (AC:L), meaning once the file is opened the overflow triggers reliably against affected default Office installations. Limiting factors: mandatory user interaction, Protected View / Mark-of-the-Web warnings and macro/file-block policies can interrupt the chain, and only the listed Windows and macOS Office builds (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office LTSC/365 for Mac) are affected. Code executes with the privileges of the user who opens the document, not SYSTEM.

Signals are moderately consistent but incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 HIGH) describes a network-reachable, low-complexity, unauthenticated remote code execution that is gated by user interaction - the classic 'open a malicious document' Office file-parsing pattern, consistent with the CWE-122 heap-based buffer overflow and the RCE/Buffer Overflow/Heap Overflow tags. No EPSS score, no CISA KEV listing, and no POC indicator were supplied, so there is NO evidence of active exploitation or public exploit code at time of analysis; the only confirmed external signal is that a vendor patch exists (MSRC update guide). The UI:R requirement meaningfully lowers real-world risk versus a fully wormable AV:N flaw, since exploitation depends on social-engineering a user into opening a crafted file. Net: this is a credible, patch-now priority given Office's ubiquity and the memory-corruption RCE nature, but it is NOT (on the data provided) a confirmed in-the-wild threat - treat it as high-severity-by-CVSS pending any KEV/EPSS escalation. Note missing data: EPSS/KEV/POC fields are all absent rather than explicitly negative, so exploitation likelihood could not be quantified and should be re-checked against CISA KEV and MSRC exploitability assessment.

An attacker crafts a malicious Office document that triggers a heap buffer overflow in the Office file parser and delivers it via phishing email or a download link. When the victim opens the document, the overflow corrupts heap memory and the attacker executes arbitrary code in the context of the user. No public exploit code is identified at time of analysis.