EUVD-2026-102440Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Word document
-
DeliveryDeliver via email or network link
-
ExploitVictim opens file triggering heap overflow
-
ExecutionExecute arbitrary code as user
-
ImpactCompromise host and data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open or preview an attacker-crafted Word document in an affected build of Microsoft 365 Apps for Enterprise or Office LTSC 2021/2024 - the heap overflow is triggered during file parsing (CWE-122). Per CVSS PR:N, no authentication to any system is required of the attacker, but UI:R is the key limiting factor: the attack cannot succeed without user interaction (opening the malicious file), so it relies on social engineering/phishing delivery rather than fully unattended remote exploitation. Protected View, blocking of files from untrusted sources (Mark-of-the-Web), and user caution each reduce realistic exploitability. |
| Impact | This is a genuine high-priority issue, not merely a high-CVSS paper risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes network-reachable, low-complexity, unauthenticated code execution against a ubiquitously deployed product (Microsoft Office/Word), with full confidentiality, integrity, and availability impact - the classic weaponizable malicious-document profile (CWE-122 heap overflow). The one mitigating signal is UI:R: the victim must open or preview a crafted file, so exploitation is not fully automatable and depends on social engineering. No EPSS score, CISA KEV listing, or POC indicator is present in the input, so there is no evidence of active exploitation or public exploit code at this time; per the precision rule this is 'no public exploit identified at time of analysis.' Note the signals are consistent rather than conflicting (network vector aligns with document-delivery-over-network RCE), but the absence of EPSS/KEV/POC data means real-world exploitation likelihood cannot be quantified from the provided sources and should be re-checked against MSRC and CISA KEV before final triage. Given the product's enormous install base and the historical attractiveness of Office memory-corruption bugs to both commodity and targeted actors, this warrants prompt patching. |
| Exploit ScenarioDerived | An attacker emails a specially crafted Word document (or hosts it on a network share or web link) to a target and lures them into opening it. Parsing the malformed file triggers a heap-based buffer overflow in Word, allowing arbitrary code execution in the context of the user. No public exploit code is identified in the provided data, but the low attack complexity makes reliable exploitation plausible once a technique is developed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Heap-based buffer overflow in Microsoft Word allows remote unauthenticated attackers to execute arbitrary code when a victim opens a specially crafted document. Affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. No public exploit identified at time of analysis, but this is a genuine high-priority issue given the potential for code execution and widespread product deployment; exploitation requires user interaction (opening or previewing the malicious file).
RemediationAI
Install the latest security updates for Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 as provided by Microsoft (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108428). If immediate patching is not possible, enable Protected View for all untrusted documents and enforce Mark-of-the-Web (MOTW) to block files from the internet; note that Protected View may be bypassed if users enable editing, and MOTW can be stripped via certain archive formats. Additionally, disable automatic preview of email attachments and conduct user awareness training to avoid opening suspicious Word documents. These mitigations reduce the attack surface but do not fully eliminate the risk, as the vulnerability requires user interaction to exploit.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft Word's document parsing engine. When Word processes a malformed document, it writes data beyond the allocated heap buffer, corrupting memory and potentially allowing an attacker to execute arbitrary code. The affected products identified by CPE are Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. The CVSS vector indicates the attack is network-based (AV:N) with low complexity (AC:L) and no privileges required (PR:N), but user interaction (UI:R) is required to open the malicious file. This makes the attack reliant on social engineering or phishing delivery. The patch is available from the vendor per the MSRC advisory.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious document delivered over network (AV:N) with no attacker privileges (PR:N) but requiring the victim to open it (UI:R); memory-corruption RCE yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Word, a core productivity application across the organization, is affected by a high-severity vulnerability that could allow an attacker to run malicious code when a user opens a malicious document. Although no public exploit identified at time of analysis, the widespread deployment of Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 means a successful attack could lead to data loss, operational disruption, or lateral movement. Leadership should prioritize immediate patching and reinforce user awareness to mitigate this risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
GitHub PoC
Exploit-DB