Microsoft Word CVE-2026-70268

Exploitation requires the victim to open an attacker-supplied, specially crafted Word document (UI:R) - there is no zero-click or purely remote trigger despite the AV:N rating. No authentication is required of the attacker (PR:N), and no special product feature or non-default configuration is needed; any default Word installation that opens the malicious file is affected. The limiting factors are therefore squarely the user-interaction requirement (the file must be delivered and opened, typically via phishing) and the fact that code executes only in the context of the user who opened the document (S:U, no privilege escalation across a trust boundary). Affected products per EUVD include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding Office for Mac editions; verify exact patched builds (e.g. 16.0.17932.21056 for LTSC 2024) against the MSRC advisory.

This is a genuine high-priority patch item, but not a drop-everything emergency based on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-deliverable, unauthenticated code-execution flaw whose single mitigating factor is required user interaction (UI:R) - i.e. the victim must open a malicious Word document. No EPSS score, CISA KEV entry, SSVC decision, or public POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The risk calculus therefore rests on: (a) the enormous install base of Microsoft Word, (b) the reliability and historical weaponization of heap-overflow RCE bugs in Office parsers, and (c) the low complexity (AC:L). Absence of EPSS/KEV is a data gap, not evidence of safety - malicious-document RCE in Office is a perennial phishing and initial-access target, so defenders should treat this as high priority even though no exploitation signal is currently confirmed. The one point to verify: AV:N is Microsoft's standard rating for document-delivered attacks (the file arrives over the network), but actual exploitation is local file-open behavior gated by UI:R - do not read AV:N as fully remote/zero-click.

An attacker emails or otherwise delivers a specially crafted Word document to a target and uses social engineering to get it opened. When the victim opens the file, the malformed content triggers a heap-based buffer overflow in Word's parsing code, corrupting memory and allowing the attacker to execute arbitrary code in the context of the victim user. No public exploit code was identified in the provided data, but heap-overflow Office RCE is a well-trodden phishing technique.