Microsoft Word CVE-2026-88185

Exploitation requires a vulnerable, unpatched Microsoft Office/Word build (Office LTSC 2021 before 16.0.14334.20974, Office LTSC 2024 before 16.0.17932.21056, Microsoft 365 Apps for Enterprise, or the Mac LTSC/365 editions) to process an attacker-crafted Word document delivered over a network (email attachment or web download). The CVSS vector claims UI:N, suggesting a rendering/preview-pane path that may not require the user to fully open the file, but this should be verified with Microsoft; a maliciously-formed document is nonetheless the required trigger. Exploitation is further limited by AC:H - the attacker must achieve reliable heap layout/grooming to turn the overflow into code execution - and CISA assesses it as not automatable, so it is unsuited to mass/wormable campaigns. Applying the vendor patch fully remediates.

This is a genuinely serious memory-corruption flaw (CWE-122 heap overflow) yielding code execution with full CIA impact (C:H/I:H/A:H), but multiple signals argue against emergency-priority status. CVSS 8.1 is pulled down from critical specifically by AC:H, meaning reliable exploitation requires non-trivial conditions such as heap grooming. CISA's SSVC framework reinforces a lower real-world urgency: Exploitation=none (no observed attacks), Automatable=no (cannot be mass-weaponized/wormed), though Technical Impact=total (consistent with RCE). There is no CISA KEV listing and no public exploit referenced, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is not provided in the input, so probability-of-exploitation cannot be quantified - a notable data gap. CONFLICT TO VERIFY: the CVSS vector asserts UI:N (no user interaction), yet a heap overflow in Word 'over a network' realistically implies a victim opening or previewing a malicious document; Microsoft may be scoring the Outlook/Explorer Preview Pane path as UI:N, but defenders should verify whether any interaction is required, as this materially changes risk. Net: real and patch-worthy, but closer to a standard high-severity client-side RCE than an actively-exploited emergency.

An attacker crafts a malicious Word document that triggers a heap-based buffer overflow when processed by a vulnerable Office/Word build, then delivers it via email or a web link. When the document is rendered (per the CVSS UI:N scoring, potentially via a preview pane without the victim fully opening it), the overflow corrupts heap memory to achieve arbitrary code execution in the user's context. No public proof-of-concept or exploit code is identified at time of analysis, and the AC:H rating indicates exploitation requires reliable heap-layout control.