Microsoft Word CVE-2026-96996

Exploitation requires the victim to open a specially crafted Word document in an affected build of Microsoft Office (Office LTSC 2024 before 16.0.17932.21056, Office LTSC 2021 before 16.0.14334.20974, or Microsoft 365 Apps for Enterprise prior to the fixed release). The required limiting factor is user interaction (UI:R): the attack cannot proceed without a user actively opening the malicious file, which is why the vector is AV:L rather than AV:N. No attacker authentication or pre-existing privileges on the target are needed (PR:N). Code executes in the security context of the user who opens the file, so a low-privilege user account limits blast radius; Protected View or disabling of active content may further impede exploitation, and fully patched installations are not affected.

This is a credible, actionable priority despite the absence of active-exploitation signals. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes the classic malicious-document code-execution pattern: the attack vector is Local because the victim must open an attacker-supplied Word file, complexity is Low, no attacker privileges are needed (PR:N, i.e. unauthenticated attacker), but User Interaction is Required. No EPSS score was provided, so statistical exploitation probability cannot be weighed. KEV status is not present in the input, so there is no confirmation of active exploitation, and no POC was referenced - so this is NOT a confirmed in-the-wild threat. However, Office Word memory-corruption flaws of this exact shape (heap overflow, CWE-122, reported by Microsoft's own secure@microsoft.com and patched) are historically high-value targets for phishing and are frequently weaponized post-disclosure, which is why the ubiquity of the product elevates practical risk well above what the local AV alone might suggest. Note a nuance for triage: the vector is AV:L with UI:R rather than AV:N - the 'local' label reflects that exploitation hinges on a user opening a file, not on remote network reachability; combined with PR:N this is effectively a 'send a document and get it opened' scenario. The absence of EPSS/KEV/POC signals means prioritization rests on CVSS plus product ubiquity rather than demonstrated exploitation.

An attacker crafts a malicious Word document that triggers the heap-based buffer overflow and emails it to a target (e.g. as a phishing attachment). When the victim opens the document in an unpatched version of Microsoft Office Word, the overflow corrupts heap memory and allows arbitrary code execution in the context of the user. No public exploit code was identified at time of analysis, but the AV:L/AC:L/UI:R profile makes reliable exploitation via social engineering straightforward once a working exploit is developed.