Microsoft Word CVE-2026-70269

Exploitation requires the victim's Microsoft Office Word to process an attacker-crafted document that triggers the heap overflow in the affected file-parsing code. The official CVSS rates this UI:N (no user interaction), implying a path such as automatic rendering in the Outlook/Explorer Preview Pane rather than an explicit open - this should be confirmed with MSRC, because document-format overflows normally require the user to open the file (UI:R), which materially limits realistic exploitation. Limiting factors: AC:H indicates the overflow is difficult to trigger reliably (specific heap grooming/memory layout required); exploitation is confined to affected versions (Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021 and their Mac equivalents, and Office 365 for Mac) and is mitigated by the available vendor patch. SSVC Automatable=no means it is not suited to automated mass exploitation.

This is a serious but not emergency-tier vulnerability. The signals are partially conflicting. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated flaw requiring no user interaction, which for a document-parsing bug in Microsoft Office Word is unusual and worth verifying - heap overflows in Word are typically triggered when a victim opens or previews a crafted document, which would normally warrant UI:R; the UI:N rating may reflect a Preview Pane / automatic-rendering attack path, so treat 'no user interaction' with caution. The high attack complexity (AC:H) already tempers raw exploitability, indicating the overflow is not trivially reliable. CISA's SSVC framework reinforces a measured priority: Exploitation=none and Automatable=no, meaning no observed exploitation and no reliable mass/automated weaponization, though Technical Impact=total aligns with the C:H/I:H/A:H full-compromise outcome. There is no KEV listing, no public POC identified, and no EPSS score supplied, so predicted exploitation probability is unknown from this data. Net: a high-impact RCE in an extremely widespread product with a patch available, but currently without evidence of exploitation or automation - a 'patch promptly on normal cadence' issue rather than a drop-everything KEV emergency, with the UI:N claim being the key item to validate against the MSRC advisory.

An attacker crafts a malicious Word document that triggers a heap-based buffer overflow in Office Word's parsing code and delivers it via email or a web download. When the document is processed (opened, or potentially auto-rendered in the Preview Pane per the UI:N rating), the overflow corrupts heap memory to achieve arbitrary code execution in the user's context. No public exploit identified at time of analysis, and high attack complexity suggests exploitation is not fully reliable.