Microsoft Word EUVD-2026-102452

Exploitation requires the victim to open an attacker-supplied, maliciously crafted Word document in an affected build of Microsoft Office Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the corresponding Mac editions); the overflow is triggered during document parsing. The attacker needs no credentials (PR:N) and no prior access to the target system, but the required user interaction (UI:R - opening the file) is the primary limiting factor, meaning delivery typically depends on social engineering such as phishing. Protected View or blocking documents from untrusted sources (mark-of-the-web) can reduce the likelihood that the parsing path is reached with full privileges.

This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity flaw requiring no privileges but requiring user interaction (opening a malicious Word document), with high impact to confidentiality, integrity, and availability - consistent with arbitrary code execution in the user's context. No EPSS score, KEV listing, or public POC was provided in the input, so there is no current evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' The signals do not conflict, but they are incomplete: the high CVSS is driven by impact and ease rather than by any confirmed in-the-wild activity. The UI:R requirement (a user must open the file) meaningfully lowers real-world risk versus a zero-click flaw, though document-based RCE in Office has historically been a favored and highly effective phishing vector, so the practical risk remains elevated given the product's ubiquity. Because EPSS/KEV/POC data are absent (not confirmed negative), defenders should treat exploitation likelihood as unknown-but-plausible rather than low.

An attacker emails or otherwise delivers a specially crafted Word document to a target; when the victim opens it, a stack-based buffer overflow in Word's parsing logic is triggered, executing attacker-controlled code with the victim's privileges. No authentication is required of the attacker, but the victim must open the file. No public exploit code was identified at the time of analysis.