Microsoft Word CVE-2026-35440

User interaction is required: the victim must actively open a maliciously crafted Word document (.doc or .docx). The attack vector is local (AV:L per CVSS), meaning the payload must be delivered to and executed on the victim's machine - this is not a remotely exploitable network service vulnerability. The attacker needs no privileges on the target system (PR:N per CVSS) but must deliver the crafted document through a social engineering vector such as email, phishing, or a shared file system. The specific Word feature, field code, or embedded content type that triggers the path traversal has not been disclosed by Microsoft. Exploitation is limited to confidentiality impact only (I:N, A:N per CVSS) - the attacker cannot modify data or disrupt availability. Non-default configurations or features are not explicitly required per available data, but the SSVC 'Automatable: no' rating confirms that mass exploitation without human interaction is not feasible.

Multiple intelligence signals converge on a low-to-moderate real-world risk assessment. CVSS base score of 5.5 (Medium) reflects High confidentiality impact but is constrained by a local attack vector (AV:L) and required user interaction (UI:R), limiting opportunistic mass exploitation. EPSS at 0.04% in the 12th percentile corroborates this: the exploit probability is very low relative to the broader CVE population. CISA SSVC confirms exploitation status as none with automatable rated no, meaning automated exploitation at scale is not feasible. There is no CISA KEV listing and no public exploit code identified at time of analysis. The most notable signal is the High confidentiality impact (C:H) under CVSS - if triggered, sensitive local files could be disclosed, which is a meaningful outcome. However, the combination of local vector, required user interaction, no automation path, and sub-13th-percentile EPSS indicates this is unlikely to be prioritized by opportunistic threat actors. Organizations with strict data loss prevention requirements or handling of highly sensitive documents should patch promptly; others may schedule this within normal patch cadence.

An attacker sends a target a crafted Word document via email or a shared drive - no special privileges are required to create the document. When the victim opens the file, Word's document processing engine resolves embedded file path references that traverse local directory structures, causing the contents of sensitive files to be exposed to an external party controlled by the attacker. No public exploit code for this specific CVE has been identified at time of analysis.