EUVD-2026-99720
GHSA-qj8r-m7gw-387x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEmail crafted Word document to victim
-
ExploitVictim opens file in Microsoft Word
-
ExecutionTrigger untrusted pointer dereference during parsing
-
ImpactExecute arbitrary code in user context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Untrusted pointer prevention
|
| Exploitation Conditions | Exploitation requires the victim to open (or possibly preview) a specially crafted Microsoft Office Word document that triggers the untrusted pointer dereference; affected builds are Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise (fixed build unspecified in EUVD). The primary limiting factor is user interaction - a user must handle the malicious file - which contradicts the provided UI:N metric and meaningfully reduces real-world risk versus the 9.8 score; no authentication is required of the attacker (PR:N), and code runs with the privileges of the user who opens the document. |
| Impact | The input assigns CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), implying unauthenticated remote code execution with no user interaction, which on its face is a top-priority flaw. However, the signals conflict with the vulnerability class: CWE-822 (untrusted pointer dereference) in Microsoft Office Word is a document-parsing memory-corruption bug that in practice requires a victim to open or preview a crafted file, yet the provided vector states UI:N - this discrepancy should be verified against the Microsoft advisory, as the realistic vector is likely UI:R (user must open the document) unless preview-pane triggering is confirmed. Counterbalancing the high CVSS: CISA's SSVC framework lists Exploitation as 'none' (no observed exploitation), the CVE is not in CISA KEV, no public POC is referenced, and no EPSS score was provided, so exploitation probability cannot be quantified. SSVC does flag Automatable='yes' and Technical Impact='total', meaning that IF a reliable exploit emerges it could be weaponized at scale against a very widely deployed product. Net assessment: treat as a high patching priority because of the critical impact and the near-ubiquity of Microsoft Office, but current evidence points to no active or public exploitation - this is a 'patch promptly' item, not an 'emergency, exploitation underway' item. |
| Exploit ScenarioDerived | An attacker emails or hosts a specially crafted Word document that, when opened by a victim, triggers dereference of an attacker-controlled (untrusted) pointer during parsing, corrupting memory to run attacker code in the context of the user. No public exploit or POC is referenced in the provided data, and SSVC reports no observed exploitation. Given AV:N, the malicious file is delivered remotely (email/web), but realistic execution hinges on the user opening or previewing the document. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Remote code execution in Microsoft Office Word is possible when a crafted document exploits an untrusted pointer dereference (CWE-822), letting an attacker run arbitrary code with the privileges of the user who opens the file. Affected builds are Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, and Microsoft 365 Apps for Enterprise (channel-based, fix delivered through the Microsoft Office security release channel). The input rates this 9.8 with a UI:N vector, but the independent assessment resolves user interaction as required (UI:R) because the victim must open - or conceivably preview - the malicious Word document, and no authentication is required of the attacker (PR:N); that interaction requirement materially lowers real-world risk below what a 9.8 no-interaction score implies, and there is no public exploit identified at time of analysis (CISA SSVC records Exploitation: none, and KEV/PoC signals are absent). Microsoft has released vendor patches, so the exposure window is bounded by patching cadence.
RemediationAI
Vendor-released patch: update Microsoft Office LTSC 2021 to 16.0.14334.20974 or later and Microsoft Office LTSC 2024 to 16.0.17932.21056 or later, and for Microsoft 365 Apps for Enterprise apply the current update from the Microsoft Office security release channel at https://aka.ms/OfficeSecurityReleases; the Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70300 carries the per-channel build details and should be used to confirm the exact fixed build for subscription installs. Prioritize endpoints where users routinely open documents from email or the web, since exploitation requires the victim to open (or preview) a malicious Word file and code then runs with that user's privileges. Until patching completes, keep Word files opened from the internet in Protected View and disable the Outlook/Explorer preview pane for Office documents - the trade-off is reduced convenience in document-heavy workflows and, for Protected View, some loss of editing access until the user explicitly enables editing. Enable the Microsoft Defender attack surface reduction rules 'Block Office applications from creating child processes' and 'Block Office applications from injecting code into other processes' in audit-then-enforce mode to interrupt post-exploitation behavior, accepting that some legitimate document automation and add-ins may be blocked and require exclusions. Consider running Word with lower-privilege accounts or in an isolated/containerized session for untrusted content, and monitor for WINWORD.EXE spawning script interpreters or making unusual outbound connections; these are compensating controls only and do not remove the underlying memory-corruption flaw, so patching to the fixed builds remains the primary action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-822, Untrusted Pointer Dereference: Word's document parsing/rendering path follows a pointer value that originates from attacker-controlled file content without validating that it references legitimate memory. Because Word is a native, memory-unsafe application, dereferencing an attacker-influenced pointer typically produces memory corruption that can be steered into arbitrary code execution in the context of the WINWORD.EXE process rather than a clean crash. The attack surface is the document format handlers (DOCX/DOC/RTF and associated compound structures) that Word processes on open, which is why the practical prerequisite is delivery of a malicious document plus victim interaction - the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H metrics in the source data describe a network-deliverable, low-complexity flaw with total confidentiality, integrity and availability impact, while the independent assessment corrects the user-interaction metric to UI:R. The ENISA EUVD record (EUVD-2026-99720) and the Microsoft CPE/version ranges place the affected code inside the Office LTSC 2021, Office LTSC 2024 and Microsoft 365 Apps for Enterprise servicing streams, i.e. the same shared Office code base shipped across perpetual and subscription channels, and the SSVC evaluation of Automatable: yes with Technical Impact: total indicates that once a working document is produced it can be reused at scale across targets. CISA's SSVC entry records Exploitation: none, so there is currently no evidence of opportunistic or targeted use against this specific pointer-dereference flaw.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Document-parsing RCE delivered remotely (AV:N) but requiring the victim to open a crafted Word file (UI:R); no attacker privileges (PR:N) and full C/I/A impact in user context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A critical remote code execution vulnerability in Microsoft Word (CVE-2026-70300) puts the organization's Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise users at risk of full account compromise if they open a specially crafted document. With Word deployed across nearly every knowledge worker, a single successful phishing attempt could give an attacker the same access as the victim, and although no public exploit identified at time of analysis, the breadth of the attack surface and potential for user account takeover make this a serious concern. Leadership should prioritize patching given the critical severity rating.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB