Microsoft Word EUVD-2026-102444

Exploitation requires a user of Microsoft Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the corresponding macOS editions) to open a maliciously crafted Word document, as reflected by UI:R in the CVSS vector. No authentication or prior privileges on the target are needed (PR:N), and the malicious file can be delivered over any network channel such as email or a web download (AV:N). The primary limiting factor is the mandatory user interaction: the victim must actually open the attacker-supplied document, so Protected View, Office macro/active-content hardening, and user security awareness meaningfully reduce real-world exploitability. Code executes with the privileges of the user who opens the document, not SYSTEM, which bounds immediate impact on well-segregated, least-privilege endpoints.

This is a genuine high-priority vulnerability, though not a drop-everything emergency on current signals. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-reachable, low-complexity, unauthenticated code execution with full confidentiality, integrity, and availability impact - the classic profile of a malicious-document attack where the file is delivered over a network (email, web, share) but the user must open it (UI:R). The mitigating factor is that required user interaction (UI:R) prevents fully automated, wormable spread, which is why the score lands at 8.8 rather than 9.8. No EPSS score, no CISA KEV listing, and no POC indicator were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is therefore driven by the vulnerability's inherent severity and the enormous install base of Microsoft Office rather than by observed in-the-wild activity. Because Microsoft frequently patches such Office memory-corruption bugs and threat actors routinely weaponize them via phishing shortly after disclosure, the realistic expectation is that exploitation is plausible but not yet demonstrated. Priority should be high for patch deployment given ubiquity and the trivial complexity; defenders should not downgrade it merely because EPSS/KEV data is absent - absence of those signals here reflects missing input data, not confirmed low risk.

An attacker emails a specially crafted Word document (or hosts it on a web page/file share) to a target and, through social engineering, convinces them to open it. When Word parses the malicious file, a heap-based buffer overflow (CWE-122) is triggered, allowing the attacker to execute arbitrary code in the context of the user. No public exploit code is identified at time of analysis, but the low attack complexity makes reliable exploitation likely once details are reverse-engineered from the patch.