EUVD-2026-99721
GHSA-cw5m-j449-89h4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious Word document via phishing
-
DeliveryVictim opens document in Office
-
ExploitTrigger stack-based buffer overflow in parser
-
ExecutionExecute arbitrary code as current user
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the targeted user to open or preview a specially crafted Word document (UI:R), typically delivered by email attachment or web download - this is the primary limiting factor, preventing automated mass exploitation (SSVC Automatable: no). No authentication is required of the attacker (PR:N) and no special victim-side configuration is needed; default Office installations that process the malicious file are affected. Affected builds include Microsoft Office LTSC 2021 (<16.0.14334.20974), Office LTSC 2024 (<16.0.17932.21056), Microsoft 365 Apps for Enterprise, and the Office LTSC/365 for Mac editions. Protected View or blocking documents from untrusted sources materially reduces practical exploitability. |
| Impact | Signals are moderately conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, unauthenticated, low-complexity flaw with total CIA impact - on paper a high priority. However, UI:R is decisive: exploitation requires a victim to open a malicious Word document, so 'network' here means file delivery (email/web), not a directly attackable listening service. CISA's SSVC framework reinforces a tempered view - Exploitation: none (no observed in-the-wild activity), Automatable: no (cannot be reliably sprayed because it depends on user interaction), though Technical Impact: total (full compromise if triggered). There is no CISA KEV listing and no EPSS score provided, and no public exploit is identified. Net assessment: a genuinely serious code-execution bug given Office's ubiquity, but current real-world risk is driven by social-engineering/phishing delivery rather than wormable mass exploitation. Prioritize patching because of the enormous install base and 'total' impact, not because of confirmed active exploitation. Note: EPSS data is absent from the input and cannot be weighed. |
| Exploit ScenarioDerived | An attacker crafts a malicious Word document that triggers the stack-based buffer overflow and emails it to a target or hosts it on a lure site. When the victim opens the document, the overflow executes attacker-controlled code in the context of the user, enabling full compromise of the host. No public proof-of-concept or active exploitation is reported at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Stack-based buffer overflow in Microsoft Word affects Office LTSC 2021, Office LTSC 2024, Microsoft 365 Apps for Enterprise, and the Mac editions of Office, allowing a remote attacker to execute code in the context of the victim who opens a specially crafted Word document (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No attacker privileges are required, but exploitation depends on user interaction - typically an email attachment or a web-downloaded document - which is the primary limiting factor and is why CISA's SSVC assessment records Exploitation: none and Automatable: no. Microsoft has released vendor patches and no public exploit code or confirmed active exploitation has been identified at time of analysis.
RemediationAI
Apply the vendor patch: Microsoft Office LTSC 2021 should be updated to build 16.0.14334.20974 or later, Microsoft Office LTSC 2024 to build 16.0.17932.21056 or later, and Microsoft 365 Apps for Enterprise to the current channel build as described in Microsoft's rolling release list at https://aka.ms/OfficeSecurityReleases; follow the Microsoft Security Update Guide entry (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83891) for the macOS Office LTSC 2021/2024 and Office 365 for Mac fixes, since exact Mac build numbers were not published in the available data. If patching must be staged, reduce exposure by enforcing Protected View for documents originating from the internet and email, and by disabling the Outlook reading-pane/attachment preview so files are not parsed without an explicit open - the trade-off is user friction and occasional false positives on legitimate documents. Where legacy formats are not operationally required, use Office File Block settings to block or prompt on .doc/.rtf and other legacy Word formats, accepting that users lose one-click access to those files. Consider Defender Attack Surface Reduction rules such as 'Block all Office applications from creating child processes' and 'Block Office applications from creating executable content', understanding these can break legitimate add-ins, templates, and document automation. Finally, since the attacker's payoff requires post-exploitation network activity from the Word process, restrict outbound egress from user workstations and filter/block inbound office documents and archives at the mail and web gateways as compensating controls while patching proceeds. No vendor-released patch gap exists for the Windows builds listed; patch data indicates availability from the vendor, and no public exploit code has been identified for this CVE at time of analysis, so prioritization can follow standard Microsoft Patch Tuesday cycles rather than emergency escalation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a stack-based buffer overflow in Microsoft Word's document handling code: malformed input in a crafted Word file overruns a fixed-size stack buffer, corrupting adjacent memory and giving the attacker a path to controlled execution within the Word process (no privilege elevation is implied by the vector - scope is unchanged). The assigned CWE is CWE-20 (Improper Input Validation), the parent class covering the missing or insufficient validation of file-supplied data that precedes the memory-safety failure; the description's stack-overflow characterization and the CWE-20 mapping should be read together as 'unvalidated input reaches an unsafe memory write'. Attack delivery is network-based (AV:N) because the malicious document can arrive by email attachment, web download, or file share, while execution depends on the victim opening or previewing it (UI:R). Targeted builds per EUVD are Microsoft Office LTSC 2021 (16.0.1 before 16.0.14334.20974), Office LTSC 2024 (16.0.0 before 16.0.17932.21056), Microsoft 365 Apps for Enterprise (versioned through Microsoft's rolling channel at https://aka.ms/OfficeSecurityReleases), and Microsoft Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Microsoft Office 365 for Mac, for which only 'publication' placeholders are listed in the available data. No CPE strings were supplied with this record, so exact platform/build enumeration must be confirmed against the Microsoft Security Update Guide entry.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious document is delivered over the network (AV:N) and triggers reliably (AC:L) without attacker auth (PR:N), but requires the victim to open it (UI:R); code execution as the user yields full C/I/A impact in an unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity memory corruption vulnerability in Microsoft Word affects all supported versions of Office LTSC 2021, Office LTSC 2024, Microsoft 365 Apps for Enterprise, and Mac editions, allowing an unauthenticated attacker to execute code on a victim's machine if they open a specially crafted document. While no public exploit code or confirmed active exploitation has been identified at time of analysis, the broad deployment of Word means any user could be targeted via email attachment or web download, posing a significant risk to endpoint integrity and data confidentiality. Leadership should prioritize patching to prevent potential workforce-wide compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB