Microsoft Word CVE-2026-70301

Exploitation requires the victim to open or preview a specially crafted Microsoft Word document that triggers the heap-based buffer overflow (CVSS UI:R); it is NOT achievable without user interaction, so it cannot be triggered by passive network traffic or automated scanning. No authentication is required of the attacker (PR:N), and no special product configuration is named in the description - any default installation of the affected Office Word builds is vulnerable. Limiting factors that reduce realistic risk: the mandatory user action to open the file, reliance on social engineering/phishing for delivery, and the non-automatable nature confirmed by SSVC. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows), and Office LTSC for Mac 2021/2024 and Office 365 for Mac, so both Windows and macOS deployments below the fixed builds are in scope.

This is a credible high-priority issue, but not the top tier of 'drop everything' emergencies. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-delivered, unauthenticated code execution with full confidentiality/integrity/availability impact, gated only by required user interaction (UI:R) - i.e. a victim must open a malicious Word document. The signals are internally consistent but point to targeted rather than mass exploitation: CISA's SSVC decision data lists Exploitation=none and Automatable=no, which aligns with the UI:R requirement (an attack cannot be worm-like or self-propagating because it needs a human to open a file), while Technical Impact=total matches the C:H/I:H/A:H impact metrics. There is NO CISA KEV listing and NO public exploit identified in the provided data, so this reflects no public exploit identified at time of analysis. EPSS is not supplied, so exploitation probability cannot be quantified from this input - that is a genuine data gap, not evidence of low risk. Overall: a real priority to patch given the ubiquity of Office Word and the total technical impact, but the mandatory user interaction and non-automatable nature mean realistic exploitation is phishing/social-engineering-driven rather than opportunistic scanning.

An attacker emails a weaponized Word document (or hosts it on a share/web link) to a target and, through social engineering, convinces them to open it. When the document is parsed, it triggers the heap-based buffer overflow in Word, allowing arbitrary code execution in the context of the user. No public proof-of-concept or active exploitation is indicated in the available data, so this scenario is inferred from the CVSS vector (AV:N, UI:R) and CWE-122.