EUVD-2026-29687
GHSA-6449-fjcw-2pg6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Local vector and low privileges are required per description of an authorized local attacker; high C/I reflect the confidentiality and integrity impact, with no availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.
AnalysisAI
Spoofing in Microsoft Word for Android (versions 16.0.0.0 up to but excluding 16.0.19822.20190) stems from an improper access control weakness (CWE-284) that an already-authorized local attacker can abuse to misrepresent content or identity. The CVSS 3.1 vector (AV:L/PR:L) confirms a local, low-privileged authenticated attacker is required, and SSVC rates technical impact as total despite no listed availability impact. There is no public exploit identified at time of analysis, EPSS is a very low 0.04% (12th percentile), and it is not on the CISA KEV list.
Technical ContextAI
The affected component is the Android build of Microsoft Word, identified precisely by CPE cpe:2.3:a:microsoft:microsoft_word_for_android. The root cause is classified as CWE-284 (Improper Access Control), meaning the application fails to correctly enforce restrictions on who may perform certain actions or access certain resources. In a mobile Office document context this typically manifests as a spoofing condition where trust boundaries within the app or its document rendering/identity presentation are not properly enforced, allowing an authorized user to make malicious content appear legitimate. Microsoft's tags reinforce this as an Authentication Bypass class issue within the Microsoft product family.
RemediationAI
Vendor-released patch: update Microsoft Word for Android to version 16.0.19822.20190 or later, which resolves the flaw per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41101. On managed fleets, push the update through the Google Play managed store or your MDM/EMM app-update policy to ensure devices move off vulnerable builds. Because exploitation requires local, low-privilege access on the device, interim compensating controls include restricting installation of untrusted apps and documents, enforcing device compliance (screen lock, no side-loading) via MDM, and limiting who can access shared devices where a low-privileged local user could operate - these reduce the pool of potential local attackers but do not remove the underlying flaw, so patching remains the only complete fix.
More in Microsoft Word For Android
View allSpoofing in Microsoft Office (Office LTSC for Mac 2021/2024 and Excel/Word for Android) lets an attacker with local acce
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop a
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today