EUVD-2026-102442Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Word document via email
-
DeliveryVictim opens malicious file
-
ExploitTrigger heap buffer overflow in Word parser
-
ExecutionCorrupt heap memory layout
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied Word document (CVSS UI:R), which is the concrete limiting factor - there is no unattended/automatic remote trigger. Affected products are Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office 365/LTSC for Mac 2021/2024 per the CPE list, so the target must run one of these Word-containing Office builds. No authentication is needed on the attacker side (PR:N) and no special non-default Office configuration is indicated by the description; the practical constraints are social-engineering the user into opening the file and (potentially) bypassing Protected View or Mark-of-the-Web warnings for files from the internet. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated code-execution flaw whose single mitigating factor is required user interaction (UI:R) - consistent with a malicious Word document that must be opened by a victim rather than a fully wormable remote exploit. No EPSS score, CISA KEV entry, or public POC was supplied in the input, so there is no positive signal of active or imminent exploitation at this time; the risk is driven by severity and reach rather than observed attacks. No SSVC decision data was provided. Weighing the signals: the technical impact is total (C/I/A all High) and the affected product (Microsoft Office Word) is extremely widespread, which makes this a genuine patching priority, but the UI:R requirement and absence of any exploitation evidence mean it is a high-severity latent risk rather than a confirmed in-the-wild emergency. Note a minor tension to verify: the description phrases the vector as code execution 'over a network' while the attack realistically requires a user to open a delivered file, which the CVSS vector correctly captures with UI:R - the 'network' qualifier refers to delivery reach, not unattended remote exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malicious Word document that triggers the heap-based buffer overflow in Office Word's file parser and delivers it via email or a web link. When the victim opens the document, the overflow corrupts heap memory and allows arbitrary code execution in the context of the user. No public exploit code was identified in the provided data, so this scenario is inferred from the CVSS vector (AV:N, UI:R) and CWE-122. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Heap-based buffer overflow in Microsoft Word (CWE-122) allows an unauthorized attacker to execute code in the context of the victim when a specially crafted Word document is opened, earning a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw affects Word as shipped in Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021 and 2024 on both Windows and macOS. Exploitation is unauthenticated from the attacker's side but requires the victim to open an attacker-supplied file, so success depends on social engineering and on getting past Protected View or Mark-of-the-Web warnings for documents downloaded from the internet. No public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); patch data indicates a vendor fix is available via the Microsoft Security Response Center advisory.
RemediationAI
Apply the Microsoft-supplied update for CVE-2026-108430 as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108430, which lists the fixed builds for each affected channel (Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021/2024, and Office LTSC for Mac 2021/2024); patch data confirms a vendor solution is available, though specific version numbers must be taken from the advisory rather than assumed. Microsoft 365 Apps should require no manual action if the update channel is functioning, while LTSC and Mac installations typically need the monthly security update deployed through the normal servicing path - validate the applied build against the advisory table after deployment, since a partially updated channel leaves the document-parsing flaw reachable. Until patching completes, the practical compensating controls are the ones that defeat the required user interaction: keep Protected View and Application Guard enabled for files originating from the internet, ensure Mark-of-the-Web and email attachment previews are not routinely bypassed, and block or quarantine high-risk document formats at the email and web gateways - the trade-offs are reduced usability for legitimate documents and potential false positives on encapsulated or signed files. Running Word with reduced privileges or in a restricted sandbox limits the blast radius of a successful heap overflow but does not remove the vulnerability, and disabling macros or ActiveX does not help here because the corruption occurs during document parsing rather than through scripting; there is no configuration switch that fully neutralizes this defect, so the update remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a heap-based buffer overflow (CWE-122), a memory-safety defect in which the application writes more data into a heap-allocated buffer than it can hold, corrupting adjacent heap metadata and objects. In Office document-parsing contexts this class of bug typically arises when Word processes malformed structures inside a crafted file and mis-computes a length, count, or record size before copying data, giving an attacker a controlled out-of-bounds write that can be steered toward code execution in the Word process. The CPE inventory confirms the vulnerable code path is shared across the Microsoft Word builds in Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and the 2021/2024 LTSC releases for Mac, indicating a common document-handling component rather than a Windows-only or Mac-only defect. Because the overflow is memory corruption rather than a logic or configuration error, there is no feature toggle that removes the exposure; the only reliable fix is the corrected build. The assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) matches this profile: reachable over a network via a delivered file, low attack complexity, no attacker authentication, no scope change, and high confidentiality, integrity, and availability impact within the Word process, with user interaction as the sole structural mitigation.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File delivered over network (AV:N) with no attacker privileges (PR:N) but requires the victim to open the document (UI:R); heap overflow yields full code execution, so C/I/A all High.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity Microsoft Word vulnerability could let an attacker execute code as the victim after a crafted document is opened, affecting Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021 and 2024 on Windows and macOS. Because Word is widely used across the organization, successful exploitation could lead to unauthorized code execution, data exposure, and endpoint compromise, making patching and user caution a leadership priority. The issue is unauthenticated from the attacker's perspective but requires victim interaction; no public exploit identified at time of analysis and no CISA KEV listing is present, with patch available per vendor advisory.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
GitHub PoC
Exploit-DB