Microsoft Word EUVD-2026-102446

Exploitation requires the victim to open or preview an attacker-crafted Word document in an affected build of Microsoft Word - specifically Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the corresponding Office for Mac (LTSC 2021/2024 and 365 for Mac) editions per the CPE list. The decisive limiting factor is the mandatory user interaction (UI:R): there is no server-side or zero-click path implied, so the document must be rendered by the user. Impact is confined to information disclosure (C:H, I:N, A:N) - a memory read leak, not code execution or tampering - which further bounds realistic risk even though the attacker needs no prior authentication (PR:N).

This is a genuine but moderate-priority issue rather than an emergency. The CVSS 6.5 (MEDIUM) rating is driven by high confidentiality impact (C:H) combined with a network attack vector (AV:N) and no privilege requirement (PR:N), but it is held back by the mandatory user-interaction requirement (UI:R) - a victim must open or preview a maliciously crafted Word document. No EPSS score was supplied, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent: an unauthenticated network vector that nonetheless depends on social engineering, yielding information disclosure only (I:N, A:N - no integrity or availability impact). The practical risk is memory disclosure (e.g., leakage of adjacent heap/stack contents such as pointers, tokens, or document fragments that can aid further exploitation or ASLR bypass) rather than direct code execution. Verify affected-build numbers against the Microsoft MSRC advisory, as the input provides only product-level CPEs without specific fixed versions.

An attacker emails or hosts a specially crafted Word document and lures a user into opening it (or previewing it in a reading/preview pane). When Word parses the malformed structure, an out-of-bounds read exposes adjacent process memory, which the document or a paired channel can exfiltrate to the attacker. No public proof-of-concept is known, and the AV:N/AC:L profile means delivery is easy but success still hinges on the victim opening the file (UI:R).