EUVD-2026-44185
GHSA-v79p-vgmv-rcc2
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened by the victim so AV:L and UI:R; no auth needed (PR:N), low complexity (AC:L), and code execution yields full C:H/I:H/A:H in the user's context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer overflow in the file-parsing path, letting an attacker who convinces a victim to open a crafted document run arbitrary code with the victim's privileges. It affects a broad Office footprint including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, the macOS editions, and SharePoint Server 2016/2019/Subscription Edition. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 7.8 CVSS and Word's ubiquity make it a routine priority patch.
Technical ContextAI
The root cause is CWE-190 (integer overflow or wraparound), a class where an arithmetic operation - typically a length, count, or size calculation during document parsing - exceeds the storage width and wraps to a small or negative value, causing an undersized allocation followed by an out-of-bounds write (the tags also cite Buffer Overflow, consistent with an overflow-driven heap/buffer corruption). The affected technology is the Office rich-text/Word document rendering engine shared across the Click-to-Run Microsoft 365 Apps for Enterprise, MSI-based Office 2019 and Office LTSC 2021/2024, the Office for Mac builds, and the SharePoint server-side Office rendering stack. CPE data confirms the vulnerable code is present in both desktop Office (Windows and macOS) and server-side SharePoint (Enterprise Server 2016, Server 2019, Subscription Edition), meaning the same parsing flaw is reachable wherever Word-format content is processed.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55033, which lists the exact patched builds per channel (the provided data confirms a fix is available but does not carry a specific version string, so pull the precise KB/build from that advisory). For Click-to-Run Microsoft 365 Apps and Office for Mac, ensure automatic updates are enabled or push the current channel build; for MSI Office 2019 and Office LTSC, deploy the corresponding monthly security update; for SharePoint Server 2016/2019/Subscription Edition, apply the server-side Office update and restart affected services. As compensating controls until patched, open untrusted documents in Protected View / Application Guard to sandbox the parser (trade-off: users may disable it for editing), block or quarantine inbound Office attachments from untrusted senders at the mail gateway (trade-off: may delay legitimate documents), and restrict macro/content by policy - noting these reduce but do not eliminate exposure since the flaw is in document parsing itself, not macros.
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a ma
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today