What is the CVSS score of CVE-2026-26110?

CVE-2026-26110 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by CVE-2026-26110?

A critical type confusion vulnerability in Microsoft Office (CVE-2026-26110) allows local code execution with high severity (CVSS 8.4).. A patch is available.

How to fix or mitigate CVE-2026-26110?

Within 24 hours: Inventory all Microsoft Office deployments and identify users with administrative access or those handling external documents; communicate vulnerability status to stakeholders. Within 7 days: Implement application whitelisting for Office processes, restrict Office macro execution policies, and disable unnecessary Office features; conduct user awareness training on document handling. Within 30 days: Establish network segmentation to isolate high-risk systems; monitor for exploitation attempts; coordinate with Microsoft for patch timeline and plan immediate deployment upon availability.

Microsoft CVE-2026-26110

HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-03-10 secure@microsoft.com

Microsoft Authentication Bypass Memory Corruption

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 8.4

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office and 365 Apps stems from a type confusion vulnerability in memory handling that allows unauthenticated attackers to execute arbitrary code with system privileges. The vulnerability affects Office Long Term Servicing Channel deployments and requires only local access with no user interaction to trigger. No patch is currently available, making this a critical risk for organizations running affected Office versions.

Technical ContextAI

This vulnerability (CWE-843: Access of Resource Using Incompatible Type (Type Confusion)) Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.