Microsoft Word CVE-2026-88167

Exploitation requires the victim to open an attacker-supplied, specially crafted Word document (UI:R) - this is the primary limiting factor and prevents unattended or wormable mass exploitation. No authentication or prior privileges are needed (PR:N), and the flaw is reachable against default Word configurations (no special feature or non-default setting is called out in the description). The attack is confined to information disclosure: it leaks memory contents but does not, on its own, modify data or crash the application (I:N/A:N). Realistic risk is therefore gated by social-engineering success in getting a user to open the document.

This is a medium-severity (CVSS 6.5) information-disclosure flaw whose real-world priority is moderate at best, and the available signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a network-delivered, low-complexity, unauthenticated bug that nonetheless REQUIRES user interaction (UI:R) and yields confidentiality impact only (C:H, I:N, A:N) - i.e., memory disclosure, not code execution or tampering. CISA's SSVC framework reinforces the low-urgency reading: Exploitation = none (no observed or public exploitation), Automatable = no (the required user interaction prevents mass/wormable automation), and Technical Impact = partial. There is no CISA KEV listing and no public proof-of-concept in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified. Net: this is a credible but not high-priority issue - the ubiquity of Microsoft Office/Word raises the aggregate exposure, but the mandatory user interaction, lack of integrity/availability impact, SSVC 'none/no/partial' rating, and absence of any exploit evidence argue against emergency prioritization. Patch in the next normal cycle.

An attacker crafts a malicious Word document that triggers an out-of-bounds read when parsed, and delivers it to a victim via email attachment or a web download. When the victim opens the document, Word reads beyond the intended buffer boundary and exposes adjacent process memory, which can leak sensitive data (e.g., memory layout or document/application secrets). No public exploit code is identified at time of analysis, and the attack cannot succeed without the user opening the file (UI:R).