EUVD-2026-100182
GHSA-9vh7-46f6-29f6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Word document
-
DeliveryDeliver via email or web link
-
ExploitVictim opens document
-
ExecutionTrigger heap buffer overflow in parser
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied malicious Word document (UI:R in the CVSS vector) - this is the primary limiting factor; the flaw is not triggerable without human interaction and is not server-side or wormable (SSVC Automatable: no). No authentication or privileges are required of the attacker (PR:N), and delivery is remote (AV:N) via email, file share, or web download. Affected products per EUVD include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office LTSC/365 for Mac 2021/2024; unpatched builds below the vendor-fixed versions (e.g. 16.0.14334.20974 for LTSC 2021, 16.0.17932.21056 for LTSC 2024) are vulnerable. Preview-pane or protected-view handling may further constrain or expand triggerability but is not specified in the available data. |
| Impact | This is a credible, actionable priority despite no confirmed exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes the classic Microsoft Office Word remote-code-execution pattern: an unauthenticated attacker delivers a malicious document over the network (email/web), and code executes when the victim opens it - the only gating factor is UI:R (user must open the file). Impact is total (C:H/I:H/A:H), consistent with the SSVC 'Technical Impact: total' rating. However, the signals are not uniformly alarming: CISA SSVC lists Exploitation as 'none' and Automatable as 'no', meaning no observed exploitation and the attack is not amenable to mass automation (it needs a human to open a crafted document, not a wormable network trigger). No KEV listing and no POC are present in the data, and EPSS is not provided, so near-term mass-exploitation probability cannot be quantified. Net assessment: patch promptly given the ubiquity of Word and the total-impact, low-complexity, unauthenticated profile, but there is no evidence of active or automated exploitation today - this is 'patch on normal priority cycle, elevated' rather than 'emergency' until a POC or KEV status appears. |
| Exploit ScenarioDerived | An attacker emails or shares a specially crafted Word document that triggers a heap-based buffer overflow (CWE-122) when parsed by Office Word. When the targeted user opens the file, the overflow corrupts heap memory and the attacker executes arbitrary code in the context of that user. No public exploit code is identified at time of analysis, and successful exploitation depends entirely on the victim opening the malicious document (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Remote code execution in Microsoft Office Word arises from a heap-based buffer overflow that an unauthenticated attacker can trigger by delivering a specially crafted Word document that the victim then opens; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms full compromise of confidentiality, integrity and availability of the user's session, but also confirms that user interaction (UI:R) is the gating precondition. Affected builds include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 on Windows, and Office LTSC/365 for Mac 2021 and 2024, with Windows LTSC fixed versions published as 16.0.14334.20974 (LTSC 2021) and 16.0.17932.21056 (LTSC 2024). No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA SSVC Exploitation: none, Automatable: no), and Microsoft has released patched builds, so this is a credible, actionable remediation priority rather than an emergency-compromise scenario.
RemediationAI
Vendor-released patch is available: apply the Microsoft security update for CVE-2026-88186 via the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88186) - Windows Office LTSC 2021 must reach 16.0.14334.20974 or later and Office LTSC 2024 must reach 16.0.17932.21056 or later, while Microsoft 365 Apps for Enterprise and the Mac editions (Office LTSC for Mac 2021, Office LTSC for Mac 2024, Office 365 for Mac) should be updated through their normal channels referenced in the advisory and https://aka.ms/OfficeSecurityReleases. Until patching completes, the highest-value compensating control is to stop untrusted documents from reaching the parser: enforce Protected View and Application Guard for files originating from the internet, email attachments, and other unsafe locations, and instruct users not to open unexpected Word attachments or downloaded .doc/.docx files - the trade-off is increased prompt friction and possible false positives on legitimate business documents. Disabling Explorer/Outlook preview of Word documents and blocking the file types at the mail gateway or web proxy reduce the attack surface at the cost of some user convenience and potential disruption of document-centric workflows, and Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes will blunt post-exploitation payload execution but will not prevent the initial heap corruption itself. Because exploitation requires the victim to open a malicious document (UI:R) and the flaw is not automatable per CISA SSVC, no network perimeter control alone can eliminate the risk; endpoint patching of every Word build in the affected channels remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-122, heap-based buffer overflow, meaning memory is allocated on the heap for a structure whose size is computed from attacker-controlled document data, and a subsequent write exceeds that allocation. In Word this class of bug typically lives in the parsers for the OLE/CFB container, the WordprocessingML or legacy binary .doc formats, embedded objects, or font and graphics records; malformed length or count fields in those records cause an undersized heap allocation followed by an out-of-bounds write, which a skilled attacker can shape into controlled heap corruption and ultimately arbitrary code execution in the context of the WINWORD.EXE process. Because the vector carries PR:N with UI:R, the attacker needs no credentials and no prior foothold on the target - only a user willing to open a file delivered over the network via email attachment, file share, or web download. Notably, SSVC marks the issue Automatable: no with Exploitation: none, and the vector is scope-unchanged (S:U), indicating a classic client-side, non-wormable, human-triggered document exploit rather than a server-side or self-propagating flaw. The affected EUVD inventory spans the Microsoft 365 Apps for Enterprise channel and the LTSC 2021/2024 Windows and Mac editions, all of which share the same document-parsing engine, so the flaw is present wherever an unpatched Word build parses untrusted input; the Windows LTSC 2021 build 16.0.14334.20974 and LTSC 2024 build 16.0.17932.21056 are the vendor-published thresholds, while Microsoft 365 Apps and the Mac editions are remediated through their respective update channels (https://aka.ms/OfficeSecurityReleases and the Mac publication track).
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious document delivered remotely with no attacker privileges (AV:N/PR:N/AC:L) but requires the victim to open it (UI:R); code execution yields full C/I/A impact in the user context (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Word users on Windows and Mac platforms, including Microsoft 365 Apps and Office LTSC 2021/2024, face a high-severity remote code execution vulnerability that could allow an unauthenticated attacker to fully compromise a user's session when a crafted document is opened. Although no public exploit identified at time of analysis and exploitation requires user interaction, the potential for data theft and lateral movement makes timely patching critical. Leadership should prioritize remediation to protect organizational data and maintain business continuity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB