EUVD-2026-102462Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Word document via phishing
-
DeliveryVictim opens file (UI:R)
-
ExploitTrigger heap buffer overflow in Word
-
ExecutionExecute arbitrary code as current user
-
ImpactEstablish foothold on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open or preview a maliciously crafted Word document in an affected build of Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, or Microsoft Office LTSC 2024 - the UI:R metric confirms this victim interaction is mandatory, which is the primary limiting factor and makes delivery dependent on phishing or file-sharing social engineering. The attacker needs no prior authentication or privileges on the target (PR:N) and the document can be delivered remotely (AV:N). Code executes only at the privilege level of the user who opens the file (S:U, no scope change), so running Office as a standard (non-admin) user and enabling Protected View / blocking documents from untrusted sources materially limit impact. |
| Impact | This is a credible priority for patching despite the absence of exploitation telemetry. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-deliverable, low-complexity, unauthenticated heap overflow (CWE-122) yielding full confidentiality/integrity/availability impact - i.e., arbitrary code execution in the context of the user who opens the document. The single meaningful attack constraint is UI:R: a victim must open or preview a crafted Word file, so this is not a wormable, zero-click flaw. No EPSS score, no CISA KEV listing, and no POC indicator were supplied, so by the precision rules this is 'no public exploit identified at time of analysis'; the SSVC automatable dimension would be 'no' given required user interaction, and technical impact is 'total.' The signals are internally consistent (network RCE requiring user action is the classic Office document pattern) rather than conflicting. Caveat: EPSS/KEV/POC fields are simply absent from the input - their absence is not evidence of low real-world risk, and Office document-handling flaws historically attract phishing-based exploitation quickly after patch release, so the lack of a KEV entry should be read as 'not yet observed/listed in this dataset,' not 'low threat.' |
| Exploit ScenarioDerived | An attacker emails or otherwise delivers a specially crafted Word document to a target and uses social engineering to get them to open it. Opening the file triggers the heap-based buffer overflow, executing arbitrary code with the victim user's privileges. No public exploit code was identified in the provided data, but the low attack complexity makes reliable weaponization plausible once the patch is reverse-engineered. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, where a heap-based buffer overflow (CWE-122) is triggered when a victim opens or previews a specially crafted document. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows an unauthenticated remote attacker needs no credentials, but the UI:R metric confirms victim interaction is mandatory, making delivery dependent on phishing or file-sharing social engineering. Successful exploitation yields code execution at the privilege level of the user who opened the file, with high confidentiality, integrity, and availability impact, but no scope change or privilege escalation beyond that user's context; no public exploit identified at time of analysis, and a vendor patch is available from Microsoft. This is a credible patching priority despite the absence of exploitation telemetry.
RemediationAI
Patch available per vendor advisory: apply the Microsoft fix for CVE-2026-108450 documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108450, deploying it through Windows Update/Microsoft Update, Configuration Manager, or the appropriate Microsoft 365 Apps update channel for subscription installs and the LTSC servicing path for Office LTSC 2021/2024 - note the update guide does not, in the provided data, specify an exact build number, so verify the installed build against the advisory after deployment. Until patches are fully staged, actionable compensating controls include enforcing Protected View for files originating from the internet (blocks rendering of untrusted documents but can interrupt legitimate macro-enabled workflows unless trusted locations are explicitly allow-listed), using File Block settings to prevent Word from opening legacy/suspect formats (may block business-critical templates), disabling Explorer document preview handlers so files cannot be rendered without an explicit open (reduces the preview attack vector at the cost of convenience), running Office as a standard non-administrator user and stripping administrative rights (limits code execution to user-level impact consistent with S:U but does not prevent the overflow itself), and enabling the Microsoft Defender Attack Surface Reduction rules 'Block Office applications from creating child processes' and 'Block Office applications from creating executable content' (effective at stopping common payload chains but can break signed add-ins and legitimate Office automation). Blocking untrusted attachments at the mail gateway and user awareness training for phishing and file-sharing lures directly counter the UI:R dependency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a heap-based buffer overflow (CWE-122) in the document-parsing path of Microsoft Word, meaning the application writes more data into a heap-allocated buffer than it can hold, corrupting adjacent heap structures and, in the typical exploitation pattern, enabling control-flow hijack and arbitrary code execution. The affected CPE strings identify the vulnerable code as shipping in three Windows Office product lines - cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, cpe:2.3:a:microsoft:microsoft_office_ltsc_2021, and cpe:2.3:a:microsoft:microsoft_office_ltsc_2024 - so the same Word rendering engine is shared across the subscription and perpetual LTSC channels. Because exploitation occurs during parsing/rendering of attacker-supplied content, the attack surface is the document open-and-preview path rather than a network service; the UI:R metric reflects that a malicious file must be opened or previewed, while PR:N confirms no prior authentication on the target is required. Impact is bounded by S:U: code executes as the invoking user, so ASLR, DEP, and CFG plus running Office non-elevated constrain post-exploitation reach.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Document delivered over network (AV:N) with no attacker privileges (PR:N) but mandatory victim file-open (UI:R); memory-corruption RCE in the user context yields full C/I/A with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity remote code execution flaw in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, enabling an unauthenticated attacker to execute code if a user opens a crafted document. With no public exploit identified at time of analysis, but a vendor patch available, this is a credible patching priority given Word's ubiquity in daily operations. Leadership should ensure timely remediation to prevent potential data theft, system compromise, or operational disruption from phishing-based attacks.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
GitHub PoC
Exploit-DB