EUVD-2026-44200
GHSA-x639-3674-v6hc
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious file must be opened locally (AV:L, UI:R) with no prior auth (PR:N); memory-corruption RCE gives full C/I/A in the user's process (scope unchanged).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AnalysisAI
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-based buffer overflow (CWE-121) that an attacker triggers when a victim opens a maliciously crafted document. The CVSS 3.1 vector (AV:L/UI:R) confirms this is a file-borne, local-context flaw requiring the user to open attacker-supplied content, yielding full confidentiality, integrity, and availability impact in the user's session. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Microsoft has released a patch via MSRC.
Technical ContextAI
The root cause is CWE-121, a stack-based buffer overflow, occurring in Word's parsing of document content where a fixed-size stack buffer is written beyond its bounds, corrupting adjacent stack memory including saved return addresses or structured exception handlers. The CPE data shows the affected code is shared across the Office ecosystem - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, the Mac editions (Office 365 for Mac, Office LTSC for Mac 2021/2024), Word 2016, and even SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, indicating the vulnerable Word document-parsing component is reused server-side by SharePoint for document handling. Successful overflow of the stack allows redirection of execution flow to attacker-controlled code within the process running Word or the SharePoint document parser.
RemediationAI
Patch available per vendor advisory - apply Microsoft's security update for each affected channel as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55038 (exact fixed build numbers are not included in the provided data and should be taken from that MSRC page). For Office/365/Word clients, ensure Microsoft Update or the relevant Click-to-Run/LTSC servicing channel is applied, and for the Mac editions update via Microsoft AutoUpdate. For SharePoint servers, apply the corresponding server-side update. Where immediate patching is not possible, reduce exposure by opening untrusted documents in Protected View and keeping it enabled (trade-off: users may disable it to edit), blocking or quarantining Office documents from external email and web sources at the gateway, and enabling Attack Surface Reduction rules that constrain Office child-process creation (trade-off: possible false positives for legitimate macro-driven workflows); for SharePoint, restrict document upload/processing to trusted users pending patching.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a ma
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today