Microsoft Word CVE-2026-70206

Exploitation requires the victim to open a maliciously crafted Word document (CVSS UI:R) - there is no server-side or zero-click path here; delivery is typically via email attachment, download, or shared file. No authentication or prior privileges on the target are needed (PR:N), and the attack vector is network/remote in that the document is delivered remotely, but the actual trigger is local document parsing in Word. The primary limiting factor is mandatory user interaction: without a user opening the file, the flaw cannot be triggered, which is also why CISA SSVC rates it Automatable=no. Affected products span Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Office LTSC/365 for Mac; a vendor patch is available and applying it eliminates the condition.

This is a moderate-severity information disclosure flaw with a consistent, coherent signal set that points to LOW real-world urgency despite affecting a ubiquitous product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated bug whose exploitation hinges on user interaction (UI:R) - the victim must open a crafted Word document. Impact is confidentiality-only (C:H/I:N/A:N), fitting the CWE-125 out-of-bounds read: an attacker can leak memory contents but cannot alter data or crash the service through this vector. The CISA SSVC framework reinforces low priority: Exploitation=none (no observed or public exploitation), Automatable=no (mass/automated exploitation is impractical because each attack needs a human to open a document), and Technical Impact=partial. EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. This vulnerability is NOT in CISA KEV and no POC is referenced. The signals do not conflict - a widely deployed product (Office Word) with a genuine memory-disclosure bug, but gated behind user interaction and showing no exploitation activity. One caveat to verify: C:H is rated High, yet an out-of-bounds read typically leaks adjacent memory of uncertain value; whether this reliably discloses sensitive data (vs. limited/bounded leakage) should be confirmed against Microsoft's advisory. Overall this is a patch-in-normal-cycle issue, not an emergency.

An attacker emails or otherwise delivers a specially crafted Word document to a target and uses social engineering to get them to open it. When Word parses the malformed structure, an out-of-bounds read occurs and process memory contents are disclosed back to the attacker over the network. No public exploit code is referenced, and successful exploitation depends entirely on the victim opening the file.