Microsoft Office Word CVE-2026-40421

Exploitation requires the victim user to open or preview a specially crafted Word document (UI:R per CVSS vector) - exploitation cannot occur without this user interaction, and the attack is confirmed not automatable per SSVC assessment. The attacker must be able to deliver the document to the target (e.g., via email attachment, download link, or shared drive) and must have network reachability to receive the outbound connection triggered by the malicious file path reference. No attacker authentication to the target system is required (PR:N per CVSS vector). No non-default configuration appears required - the flaw affects standard Word installations across all listed product versions. Exploitation is limited by: the mandatory user interaction (opening the file), the absence of code execution capability (information disclosure only), and network controls blocking outbound SMB/WebDAV to untrusted hosts. These limiting factors make this a lower-priority item despite the broad Office deployment footprint.

The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N reflects a low-complexity, network-reachable attack requiring no attacker authentication but mandating user interaction - the victim must open or preview the malicious document. Confidentiality impact is limited (C:L) with no integrity or availability consequences. These signals are internally consistent: the SSVC assessment independently confirms exploitation status as 'none,' the attack is not automatable, and technical impact is partial only. EPSS at 0.05% (14th percentile) is very low, indicating this flaw is not being actively scanned or exploited at scale. No POC has been identified and CISA KEV listing is absent. Despite the ubiquitous deployment footprint of Microsoft Office, real-world priority is low-to-moderate: this is a targeted, user-interaction-gated information disclosure, not a wormable or remote code execution class vulnerability. The main risk elevation scenario is credential-theft (NTLM relay) when combined with attacker-controlled network infrastructure, which could increase impact beyond the raw CVSS score suggests if chained with lateral movement.

An attacker sends a phishing email to a target employee containing a malicious Word document with an embedded UNC path (e.g., \\attacker.example.com\share\lure.docx) referencing an attacker-controlled SMB server. When the victim opens the document, Word automatically attempts to resolve the path, triggering an outbound SMB authentication request that delivers the victim's NTLM hash to the attacker's server, which can then be cracked offline or used in an NTLM relay attack. No public proof-of-concept code has been identified at time of analysis, but this UNC-coercion technique is a well-documented Office attack class requiring no special tooling.