Microsoft Office Word CVE-2026-77504

The victim must open or preview a specially crafted document file in Microsoft Office Word. The CVSS vector UI:R confirms user interaction is required - the attack does not trigger without a user opening the file. PR:N indicates no authentication to any service is required on the attacker's side. AC:L indicates no special race condition or environmental configuration is needed beyond document delivery. Limiting factors: exploitation is blocked if Protected View is enforced and the user does not exit sandbox mode; the vulnerability does not affect server-side document processing in isolation unless a user session is involved. The discrepancy between the 'Office Word' description and the Windows OS affected-version list raises the possibility that a specific Windows component (rather than a standalone Office installation) is the actual attack surface - organizations without Office installed may still be affected if the vulnerable component ships with Windows.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) indicates low-complexity network exploitation requiring only that the victim open a malicious document - a realistic phishing scenario with no elevated privileges required. Full confidentiality, integrity, and availability impact (C:H/I:H/A:H) means successful exploitation yields complete host compromise. EPSS data is not provided, and KEV status is not confirmed, so widespread automated exploitation cannot be asserted. The absence of public exploit code at time of analysis moderates the immediate urgency somewhat, though the well-understood nature of double-free primitives means skilled actors could develop reliable exploits. Even a mid-sized municipal IT team in olsztyn should treat this as urgent given the ubiquitous deployment footprint of Microsoft Office across enterprise and government networks. The mismatched affected-versions data (Windows OS builds vs. Office Word) introduces uncertainty about exact scope and should be resolved by cross-referencing the MSRC advisory directly.

An attacker crafts a malicious Word document containing a specially structured element that triggers a double-free in the Word parsing engine during document load. The document is delivered via a phishing email; when the victim opens it, the double-free corrupts heap metadata, allowing the attacker to redirect execution to shellcode and achieve arbitrary code execution in the context of the victim's user account. No public exploit code has been identified at time of analysis, but the double-free primitive in a widely targeted parser is a well-understood exploitation path.