Microsoft Word CVE-2026-88169

Exploitation requires the victim to open an attacker-crafted Microsoft Word document (UI:R), so delivery depends on social engineering via email attachment, download, or a shared file rather than a purely remote drive-by. No authentication or elevated privileges are needed on the attacker side (PR:N), and the attack works over a network in the sense that the malicious file is delivered remotely, but it cannot fire without that user action. Limiting factors: user interaction is mandatory, impact is read-only information disclosure (no code execution, integrity, or availability effect per I:N/A:N), and patched builds (Office LTSC 2024 ≥16.0.17932.21056, Office LTSC 2021 ≥16.0.14334.20974, plus updated Microsoft 365 Apps and Mac editions) are not affected.

This is a moderate-priority information-disclosure flaw, not a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) shows network reach and no privileges required, but it is gated by user interaction (UI:R) - a victim must open a malicious Word document - and its impact is confined to confidentiality (C:H), with no integrity or availability effect. All exploitation-urgency signals point low: CISA SSVC records Exploitation=none, Automatable=no, and Technical Impact=partial, which is internally consistent with the CVSS profile (user-interaction requirement makes it non-automatable, and an OOB read yields only partial/confidentiality impact). No EPSS score was supplied in the input, and there is no CISA KEV listing and no public POC, so there is no evidence of active or imminent exploitation. The 'C:H' rating is worth scrutinizing: an out-of-bounds read (CWE-125) typically leaks adjacent memory contents, which NVD scores as high confidentiality impact, though real-world data recovered is often limited and non-deterministic. Bottom line: a genuine but not top-tier issue - patch on a normal cycle, prioritizing users who routinely open externally-sourced Office documents.

An attacker crafts a malicious Word document that triggers an out-of-bounds read in Office's parsing code and emails it to a target or hosts it for download. When the victim opens the document, the flaw leaks adjacent process memory, which the attacker can exfiltrate or use to defeat memory-layout defenses ahead of a further attack. No public exploit code has been identified at the time of analysis.