EUVD-2026-29678
GHSA-m493-43x7-h3mj
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted document with no attacker privileges; user must open the file; impact is limited to partial confidentiality disclosure with no integrity or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
External control of file name or path in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
AnalysisAI
External control of file name or path (CWE-73) in Microsoft Office Word enables network-based information disclosure when a victim opens a specially crafted document, affecting Word 2016, Office 2019, LTSC 2021/2024, and Microsoft 365 Apps for Enterprise. An unauthenticated remote attacker can exploit this to coerce Word into resolving an attacker-controlled file path - likely a UNC path - causing an outbound network request that leaks sensitive data such as NTLM credentials. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.05% at the 14th percentile indicates negligible real-world exploitation activity at time of analysis.
Technical ContextAI
CWE-73 (External Control of File Name or Path) describes a weakness where an application constructs file paths using externally-supplied input without adequate neutralization, allowing an attacker to redirect file resolution to unintended locations. In Microsoft Office Word, this class of flaw is classically exploited via crafted document objects (e.g., OLE links, embedded objects, or template references) that embed attacker-controlled UNC paths (e.g., \\attacker-server\share\file), causing the application to initiate an SMB or WebDAV connection to an external host. This outbound connection can expose the victim's NTLM authentication hash or confirm file system metadata. The affected products are confirmed via CPE: cpe:2.3:a:microsoft:microsoft_word_2016, cpe:2.3:a:microsoft:microsoft_office_2019, cpe:2.3:a:microsoft:microsoft_office_ltsc_2021, cpe:2.3:a:microsoft:microsoft_office_ltsc_2024, and cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, spanning the full currently-supported Microsoft Office on-premises and subscription portfolio.
RemediationAI
The primary fix is to apply Microsoft's security update for the affected Office product. For Microsoft Word 2016, update to build 16.0.5552.1000 or later - this is the only product for which a specific confirmed fix build number is available from EUVD data. For Microsoft Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise, apply the patches documented at https://aka.ms/OfficeSecurityReleases as directed by the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40421. As a compensating control prior to patching, administrators can disable automatic resolution of external content in Word via Trust Center settings (File → Options → Trust Center → Trust Center Settings → External Content → Disable all external content), which will prevent Word from initiating outbound file-path resolution; the trade-off is that legitimate linked content and external data connections in documents will also be blocked. Additionally, network-level blocking of outbound SMB (TCP 445) and WebDAV (TCP 80/443) to untrusted external hosts will limit the data exfiltration path, though this may impact legitimate business workflows.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today