EUVD-2026-35690
GHSA-2872-gp33-8736
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office Word arises from an untrusted pointer dereference (CWE-822) that can be triggered when a victim opens a crafted document. Successful exploitation grants the attacker the privileges of the current user with high impact to confidentiality, integrity, and availability, though no public exploit identified at time of analysis. The CVSS 3.1 base score of 7.8 reflects the requirement for user interaction but no prior authentication.
Technical ContextAI
The flaw is rooted in CWE-822 (Untrusted Pointer Dereference), a memory-safety weakness in which the application uses a pointer value derived from attacker-controlled input without validating that it points to a legitimate object. In the context of Microsoft Office Word - a complex document processor that parses numerous legacy and modern formats (DOC, DOCX, RTF, embedded OLE objects) - such a dereference typically occurs while interpreting structured fields, embedded objects, or font/graphics tables, where a crafted offset or handle is dereferenced as a code or data pointer. The result is typically memory corruption that can be steered into code execution within the Word process.
RemediationAI
Apply the security update referenced in Microsoft's MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45643 (patch available per vendor advisory; an exact fix build was not provided in the input data and should be pulled from the Update Guide for each affected channel). Until patches are deployed, reduce exposure by enabling Protected View for documents from the Internet and Outlook attachments, blocking or stripping Office documents originating from external email at the mail gateway, and configuring Attack Surface Reduction rules such as 'Block Office applications from creating child processes' and 'Block executable content from email client and webmail' - these mitigations can break legitimate macro-driven workflows and inline document previews, so validate against business-critical templates before broad rollout. Where feasible, require documents to be opened in Office for the web or Application Guard for Office, which sandboxes the parsing process.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje
Same weakness CWE-822 – Untrusted Pointer Dereference
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today