Microsoft Word EUVD-2026-102451

Exploitation requires the victim to open an attacker-crafted Microsoft Office Word document (UI:R in the CVSS vector) - this is the primary limiting factor and means the attack is not fully automatable or self-propagating without human action. No authentication is required (PR:N) and no special target-side configuration is indicated by the description; the flaw is in Word's document parsing, so affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the Office for Mac variants listed in the CPEs. Code executes in the security context of the user who opens the file, so running Office under a low-privilege account limits blast radius.

This is a genuine high-priority vulnerability, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a remotely reachable, low-complexity, unauthenticated flaw whose only gating factor is user interaction - the victim must open a crafted document. A vendor patch is confirmed available via MSRC, which raises urgency because patch availability enables attacker diffing and reduces the effort to develop a working exploit. Key exploitation-intelligence signals are MISSING from the input: no EPSS probability was provided, the vulnerability is NOT listed in CISA KEV, and no POC/exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The absence of EPSS/KEV/POC data is not evidence of low risk - it is simply absent - but it means current risk rests on intrinsic severity (heap overflow → full C/I/A compromise, CWE-122) plus the historically high attacker interest in Office document RCE. No SSVC decision data was supplied. There are no internal contradictions between the CVSS vector and the description: both agree on network vector with required user interaction. Bottom line: treat as high priority for patching given ubiquitous deployment and full-impact RCE, while noting that active-exploitation and probabilistic-exploitation signals are unavailable rather than negative.

An attacker emails or otherwise delivers a maliciously crafted Word document to a target and, using social engineering, convinces the victim to open it. Parsing the malformed content triggers a heap-based buffer overflow (CWE-122) in Office Word, allowing arbitrary code execution in the context of the user. No public exploit code was identified in the provided intelligence, but document-parsing RCE in Office is a well-established, high-value attacker target.