Microsoft Word CVE-2026-88150

Exploitation requires a targeted user to open an attacker-crafted Microsoft Word document (UI:R), which is the primary limiting factor - there is no fully automatic or server-side trigger. No authentication or privileges are required on the attacker side (PR:N, unauthenticated), and the attack is delivered over a network (e.g., email attachment or download). The flaw stems from use of an uninitialized resource (CWE-908) in Word's document handling; code runs in the security context of the user who opens the file, so a low-privileged victim limits the initial blast radius absent further escalation. Affected builds per EUVD include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024 (Windows and Mac), and Office 365 for Mac.

This is a genuine priority, though not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H, base 8.8 High) describes network-reachable, unauthenticated, low-complexity code execution with full confidentiality, integrity and availability impact - but the UI:R flag is the decisive mitigating signal: exploitation requires a user to open a malicious Word document, so this is a social-engineering-dependent client-side RCE, not a wormable server-side flaw. No EPSS score, CISA KEV entry, or public POC was provided in the source data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk here is driven by the near-universal deployment of Microsoft Word and the attractiveness of Office document RCE to phishing/APT actors rather than by a confirmed exploitation signal. No SSVC decision data was supplied. Note one conflict: the input Tags label this 'Authentication Bypass', which contradicts both the CWE-908 (use of uninitialized resource) classification and the description (code execution) - the tag appears mislabeled and should not factor into prioritization.

An attacker crafts a malicious Word document that triggers the use of an uninitialized resource and delivers it to a target via phishing email, chat, or a download link. When the victim opens the document, the flaw is triggered and arbitrary code executes in the context of the user running Word. No public exploit code was identified in the source data at time of analysis.