Microsoft Office Word CVE-2026-96995

Requires a local, already-authorized/authenticated user on a host running an affected build of Microsoft Office Word - specifically Office LTSC 2021/2024, Office LTSC for Mac 2021/2024, Microsoft 365 Apps for Enterprise, or Office 365 for Mac below the fixed builds (e.g. LTSC 2021 <16.0.14334.20974, LTSC 2024 <16.0.17932.21056). Exploitation is local only (AV:L) and cannot be performed remotely or by an unauthenticated actor (PR:L). Limiting factors: the attacker must already hold valid low-level access to the machine, and a patched Office build fully removes the flaw. Note the description implies privilege elevation via Word's handling of crafted input; although the supplied vector states UI:N, Office memory-corruption flaws commonly require the victim to open a malicious document, which would be an additional limiting condition if confirmed by Microsoft.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity elevation-of-privilege flaw requiring only low privileges (an authenticated/authorized local user) and no user interaction, yielding full confidentiality, integrity, and availability impact on the host. No EPSS score is supplied, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public POC is referenced, so the exploitation status is: no public exploit identified at time of analysis. SSVC inputs (exploitation=none observed, automatable=no given local vector, technical impact=total) point to a real but not emergency priority: this is a genuine privilege-escalation primitive in ubiquitous software with a vendor patch, warranting prompt patching, but there is no current evidence of mass or automated exploitation. One signal worth verifying: the description frames this as an elevation of privilege via a stack buffer overflow in Word, yet the vector asserts UI:N - most Office memory-corruption bugs require a user to open a crafted document (UI:R). This UI:N/EoP combination is unusual and should be verified against the Microsoft advisory; if user interaction is in fact required, realistic risk is lower than the vector implies.

A low-privileged but authenticated local user on a Windows (or macOS) host with Microsoft Office Word installed triggers a crafted condition that overflows a stack buffer in Word's processing code, corrupting the stack to hijack control flow and run attacker-controlled code at a higher privilege level. The result is local privilege escalation to full host compromise. No public exploit code is identified at time of analysis.