EUVD-2026-44200
GHSA-x639-3674-v6hc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Word document
-
DeliveryDeliver via email or share
-
ExploitVictim opens file
-
ExecutionOverflow stack buffer in parser
-
ImpactExecute code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a specially crafted Word document (CVSS UI:R), so the limiting factor is user interaction - the attack cannot succeed without a user opening attacker-supplied content, and there is no remote unauthenticated path against a default client. No prior authentication to the victim's environment is needed (PR:N), and the vector is local file handling (AV:L). Realistic risk is bounded by the need for social engineering and by whatever document defenses (Protected View, mark-of-the-web gating) are enabled; the SharePoint CPEs suggest a server-side document-processing path may also reach the vulnerable parser, which would relax the interaction requirement and should be confirmed against the Microsoft advisory. |
| Impact | The signals are moderate-but-actionable. The CVSS base score of 7.8 (High) reflects local attack vector (AV:L) combined with required user interaction (UI:R) - meaning exploitation depends on convincing a user to open a crafted file rather than a remote unauthenticated network hit, which caps severity below Critical. PR:N means no prior authentication to the target is needed, but the practical barrier is social engineering (UI:R). There is no EPSS score provided and no SSVC decision data, and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation; no POC is referenced either. Impact is high across C/I/A once triggered. The SharePoint CPEs are a notable amplifier: if the same parsing path is reachable server-side via uploaded documents, the practical exposure could exceed a purely client-side 'user opens a file' model - this should be verified against Microsoft's advisory. Overall this is a routine-priority Patch Tuesday-class Office RCE: worth prompt patching given ubiquity, but not an emergency absent exploitation evidence. |
| Exploit ScenarioDerived | An attacker crafts a malicious Word document that overflows a stack buffer during parsing and emails or shares it with a target; when the victim opens the file, the overflow redirects execution and runs attacker code in the context of the user. Because UI:R is required, the attack relies on social engineering to get the document opened, and no public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-based buffer overflow (CWE-121) that an attacker triggers when a victim opens a maliciously crafted document. The CVSS 3.1 vector (AV:L/UI:R) confirms this is a file-borne, local-context flaw requiring the user to open attacker-supplied content, yielding full confidentiality, integrity, and availability impact in the user's session. No public exploit identified at time of analysis, and it is not listed in CISA KEV; Microsoft has released a patch via MSRC.
RemediationAI
Patch available per vendor advisory - apply Microsoft's security update for each affected channel as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55038 (exact fixed build numbers are not included in the provided data and should be taken from that MSRC page). For Office/365/Word clients, ensure Microsoft Update or the relevant Click-to-Run/LTSC servicing channel is applied, and for the Mac editions update via Microsoft AutoUpdate. For SharePoint servers, apply the corresponding server-side update. Where immediate patching is not possible, reduce exposure by opening untrusted documents in Protected View and keeping it enabled (trade-off: users may disable it to edit), blocking or quarantining Office documents from external email and web sources at the gateway, and enabling Attack Surface Reduction rules that constrain Office child-process creation (trade-off: possible false positives for legitimate macro-driven workflows); for SharePoint, restrict document upload/processing to trusted users pending patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 19 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-121, a stack-based buffer overflow, occurring in Word's parsing of document content where a fixed-size stack buffer is written beyond its bounds, corrupting adjacent stack memory including saved return addresses or structured exception handlers. The CPE data shows the affected code is shared across the Office ecosystem - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, the Mac editions (Office 365 for Mac, Office LTSC for Mac 2021/2024), Word 2016, and even SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, indicating the vulnerable Word document-parsing component is reused server-side by SharePoint for document handling. Successful overflow of the stack allows redirection of execution flow to attacker-controlled code within the process running Word or the SharePoint document parser.
Know when Microsoft Sharepoint Enterprise Server 2016 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious file must be opened locally (AV:L, UI:R) with no prior auth (PR:N); memory-corruption RCE gives full C/I/A in the user's process (scope unchanged).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
DescriptionCVE.org
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Executive ViewAI
Microsoft Office Word and Office 365 are vulnerable to arbitrary code execution when users open malicious documents, potentially compromising user endpoints and enabling lateral movement across the organization. Although no public exploit has been identified at time of analysis, the absence of active attacks provides a critical remediation window that must be addressed immediately. This vulnerability directly threatens any organization using Office for document handling and collaboration.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Exploit-DB