Microsoft Word CVE-2026-41101

Exploitation requires local access to the Android device running a vulnerable Word build (16.0.0.0 to <16.0.19822.20190) and the attacker must already hold some privileges on the device (CVSS PR:L), so this is not a remote or unauthenticated attack. No user interaction is required (UI:N), and the scope is unchanged (S:U). The limiting factors are significant: the attacker needs a foothold as an authorized local actor (e.g., another app or a logged-in user) on the specific Android platform, and only vulnerable versions are affected - desktop, iOS, and web Word are not in scope per available data.

Signals are consistent in pointing to moderate, not urgent, real-world risk. The CVSS base score of 7.1 is driven by high confidentiality and integrity impact (C:H/I:H) but tempered by a local attack vector (AV:L) and required privileges (PR:L), so remote mass exploitation is not possible. EPSS is extremely low at 0.04% (12th percentile) and the SSVC framework rates Exploitation as none and Automatable as no, aligning with the absence of any KEV listing or public POC - this is a priority to patch on a normal cycle rather than an emergency. One notable tension: the description characterizes the impact as 'spoofing,' yet the CVSS vector encodes C:H/I:H (high confidentiality and integrity) with A:N, and SSVC calls technical impact 'total' - the numeric impact metrics appear more severe than a pure spoofing label would suggest, so the precise real-world impact should be verified against Microsoft's advisory.

A local, low-privileged user or a co-resident malicious app on an Android device leverages the improper access control in Word for Android to present spoofed content or identity that appears trustworthy to the victim. Because the attack vector is local and requires existing privileges (AV:L/PR:L), the attacker must already have some access to the device rather than exploiting it remotely. No public exploit code is identified at time of analysis.