Microsoft Word CVE-2026-108445

Exploitation requires the victim to open a specially crafted Word document (UI:R) in an affected Office build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the corresponding Office for Mac / LTSC for Mac editions per the CPE list. No authentication or prior privileges are needed (PR:N), and attack complexity is low (AC:L), so no special non-default configuration is required beyond having a vulnerable Word version installed. The primary limiting factor is the mandatory user interaction: the attacker must socially-engineer the target into opening the malicious file, and Protected View / Mark-of-the-Web sandboxing may further impede exploitation of untrusted documents.

This is a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a remotely-reachable, low-complexity, unauthenticated code-execution flaw whose only gating factor is user interaction - the classic 'open a malicious Word document' pattern - and the high impact triple (C:H/I:H/A:H) reflects full compromise of the user's context. The 8.8 score is credible rather than inflated because no privileges are required and the affected product (Microsoft Office / Word) is deployed almost everywhere. However, key exploitation signals are MISSING from the input: there is no EPSS probability provided, no CISA KEV listing, no SSVC decision data, and no indication of public POC code - so real-world exploitation likelihood cannot be quantified from this data alone and must be treated as unconfirmed. The UI:R requirement meaningfully lowers the practical risk versus a zero-click RCE: exploitation depends on social engineering to make a victim open a crafted file. A vendor patch is confirmed available via MSRC, which is the single most actionable signal here. Net: treat as a high-priority patch-now item given ubiquity and the ease with which malicious Office documents are weaponized and phished, while noting that active-exploitation and POC status are unknown from the provided data.

An attacker crafts a malicious Word document that triggers the stack-based buffer overflow when parsed and emails or otherwise delivers it to a target. When the victim opens the document, the overflow executes attacker-controlled code in the context of the user, enabling full compromise of that session. No public POC is identified in the provided data, and exploitation requires the victim to open the file (UI:R).