EUVD-2026-100189
GHSA-c4gf-5hr6-cjpp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Word document
-
DeliveryDeliver via email or download link
-
ExploitVictim opens file in Microsoft Word
-
ExecutionUntrusted input bypasses security decision
-
ImpactCompromise user context (C/I/A high)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Trusted input validation
|
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted Microsoft Word document on the local system (AV:L, UI:R); no authentication or prior privileges are needed (PR:N). The bypass hinges on Word relying on attacker-controlled untrusted input when making a security decision (CWE-807), so the malicious file must embed the crafted input that subverts that control. The primary limiting factor is the mandatory user interaction - the attack fails unless the target actually opens the document - which constrains it to social-engineering/lure delivery rather than unattended remote compromise; Protected View or similar document-handling hardening may further reduce real-world success. |
| Impact | The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a local, low-complexity security-feature bypass that needs no privileges but does require user interaction - the classic 'victim opens a malicious document' profile for Office client flaws (CWE-807, reliance on untrusted inputs in a security decision). No EPSS score, KEV listing, SSVC decision, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Real-world priority is driven primarily by the ubiquity of Microsoft Word and the ease with which document-borne lures are delivered, not by confirmed exploitation signals. This is a genuine patch-soon issue because of product reach and the high C/I/A impacts, but absent EPSS/KEV/POC data it is not yet demonstrably weaponized - treat as high-priority-by-footprint rather than confirmed-under-attack. Note the local vector (AV:L) combined with UI:R meaningfully limits mass exploitation compared to a remote network bug. |
| Exploit ScenarioDerived | An attacker crafts a malicious Word document that supplies untrusted input to a security decision, then delivers it via email attachment or download. When the victim opens the file in Word (UI:R), the security feature is bypassed, yielding high confidentiality, integrity, and availability impact in the user's context. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
A security-feature bypass in Microsoft Word allows an attacker-crafted document to subvert an Office security decision when the file is opened on the local machine, rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact. No privileges or authentication are required, but the attacker depends entirely on convincing the victim to open the malicious document, so delivery is social-engineering based rather than unattended. This is tracked as CWE-807 (reliance on untrusted inputs in a security decision) and EUVD-2026-100189; no public exploit identified at time of analysis, and Microsoft has published a fix (patch available per vendor advisory).
RemediationAI
Patch status is vendor-released; Microsoft published a fix for this issue (patch available per vendor advisory), so the primary action is to apply the current Office security update from the Microsoft Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88210. For Microsoft Office LTSC 2024, the fixed build identified in the affected-version data is 16.0.17932.21056 - upgrade to that build or later; for Microsoft 365 Apps for Enterprise, apply the current channel release listed at https://aka.ms/OfficeSecurityReleases, and for the macOS products (Microsoft Office 365 for Mac 1.0.0, Office LTSC for Mac 2024 16.0.0, Office LTSC for Mac 2021 16.0.1) apply the corrected versions once published in the same advisory. Until every client is updated, compensating controls should target the user-interaction prerequisite (UI:R) and the untrusted-input path: keep Protected View and, where licensed, Application Guard for Office enabled for documents originating from the internet, email attachments, and untrusted network locations, and block those file types at mail and web gateways - the trade-off is that Protected View forces users through an extra 'Enable Editing' step and Application Guard opens files in an isolated container where some add-ins and macros will not function, generating helpdesk friction. Additionally, restrict execution of embedded content and ActiveX/macro objects from untrusted documents via Group Policy, which reduces the impact of a successful decision bypass but may break legitimate line-of-business documents that rely on those components. Note the residual limitation: because the flaw is a logic-level trust bypass rather than a missing user prompt, these controls reduce exposure but do not fully substitute for installing the vendor update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-807: Word makes a trust/security decision using data taken from the document itself, so attacker-controlled content inside the file can influence an outcome the application is supposed to decide safely. In Office client terms this class covers logic such as Protected View / trust determination, embedded-object or macro handling, and file-format parsing gates, where a crafted input causes the control to resolve in the attacker's favor instead of quarantining or restricting the content. The assessed vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms the attack is local to the victim's session (no network vector, no privileges, PR:N) but requires mandatory user interaction (UI:R), and impact stays within a single security scope (S:U) while being high across confidentiality, integrity, and availability. Because the bypass is a logic/trust failure rather than a memory-safety bug, the reliable exploit surface is the document content itself: the victim must open the file for the subverted decision to take effect, which is why Office document hardening and Protected View behavior are the key environmental factors. Vendor attribution is Microsoft (secure@microsoft.com), and the tracked affected codebase is the Word/Office client on Windows and macOS.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack is document-borne and requires the victim to open the file locally, so AV:L and UI:R with PR:N; no privileges needed and full high impact in user context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
Executive ViewAI
Microsoft Word users are exposed to a high-severity security feature bypass (CVE-2026-88210) that can be triggered by opening a malicious document, potentially leading to full compromise of confidentiality, integrity, and availability on the local machine. With no public exploit identified at time of analysis and a patch available per vendor advisory, the primary risk is to organizations that have not yet applied Microsoft's fix, as successful exploitation requires only user interaction and no authentication. Leadership should prioritize patching to prevent social-engineering attacks that could result in data theft or operational disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB