EUVD-2026-102453Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious Word document to victim
-
DeliveryVictim opens crafted file in Office
-
ExploitTrigger heap buffer overflow in Word
-
ExecutionCorrupt heap and hijack control flow
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-crafted Word document in an affected Office build (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 365/LTSC for Mac 2021/2024); the specific limiting factor is UI:R - the file must be opened by a user, so delivery relies on phishing or document sharing and cannot occur fully automatically. No authentication or elevated privileges are needed (PR:N), and default configurations are vulnerable, but Protected View / Mark-of-the-Web sandboxing on documents from untrusted sources materially raises the bar and can block the initial trigger until the user disables it. |
| Impact | This is a genuine high-priority vulnerability despite the absence of exploitation-probability signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity, unauthenticated code execution requiring only that a victim open a malicious Word document - a classic and historically heavily-weaponized attack pattern for Microsoft Office. No EPSS score was provided in the input, so exploitation probability cannot be quantified; no CISA KEV listing and no public POC were supplied, so there is no public exploit identified at time of analysis. The only tempering factor is UI:R (user interaction required), which prevents fully automatic/wormable spread and means exploitation depends on social engineering. The signals are consistent rather than conflicting: a network attack vector combined with UI:R is normal for file-format/client-side bugs and does not contradict the 'over a network' description (delivery is via a document sent over the network, then opened locally). Given Office's enormous install base, high technical impact, and no required privileges, this warrants prompt patching even though active exploitation is not currently confirmed. |
| Exploit ScenarioDerived | An attacker crafts a malicious Word document that triggers the heap-based buffer overflow (CWE-122) and emails or shares it with a target. When the victim opens the document, the overflow corrupts heap memory and allows the attacker to execute arbitrary code in the context of the user running Office. No public exploit code was identified in the provided data, so this scenario is based on the CVSS vector (AV:N/UI:R) rather than a confirmed POC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Heap-based buffer overflow in Microsoft Word (CWE-122) enables remote code execution when a user opens an attacker-crafted document in an affected Office build - Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, or the Mac equivalents - and rates CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R): the malicious file must actually be opened, so delivery depends on phishing or document-sharing lures rather than autonomous network exploitation, and Protected View or Mark-of-the-Web sandboxing on untrusted documents can block the trigger until the user dismisses it. Vendor patches are available via the Microsoft Security Response Center update guide; no public exploit code or confirmed active exploitation was identified at time of analysis, though the high confidentiality, integrity, and availability impact across all supported Office channels warrants prompt patching.
RemediationAI
Primary fix: apply the Microsoft update for CVE-2026-108441 - patch availability is confirmed by the vendor, so update every affected Office channel (Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021/2024, and Office LTSC for Mac 2021/2024) to the current build listed in the MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108441, using Microsoft Update, the Microsoft 365 Apps update channel, or Microsoft AutoUpdate on macOS; note that the provided data does not include an exact fix version number, so the advisory is the only authoritative source for per-channel build versions. Until patching completes, the most effective compensating controls target the UI:R delivery path rather than the parser itself: keep Protected View and Application Guard enabled for documents originating from the internet and email, and leave Mark-of-the-Web attachment handling intact - the trade-off is occasional user friction and prompts that users may click through, and these controls only help if users do not disable them; additionally block or strip risky attachment types (for example legacy .doc/.rtf and macro-bearing formats, or archive containers of them) at the email gateway and file-sharing layer, accepting that this can break legitimate business workflows; and restrict or disable ActiveX/OLE package activation and macros via Group Policy or Trust Center settings where they are not operationally required, with the side effect of breaking line-of-business documents that depend on those features. Finally, monitor and hunt for Word spawning child processes such as script interpreters or command shells (a typical post-exploitation indicator for document-borne RCE) and alert on unexpected Office crashes, since exploit attempts often fail before reliability is achieved.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a heap-based buffer overflow (CWE-122), meaning Word's document-parsing code writes past the bounds of a heap-allocated buffer while processing attacker-controlled input, corrupting adjacent heap metadata and enabling memory-corruption primitives that can be chained to arbitrary code execution in the context of the opening user. Because the flaw sits in the client-side document parser rather than a network service, the attack surface is the file itself - Word documents, and potentially the embedded OLE/RTF-style structures Word parses during open - with the CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describing a low-complexity, unauthenticated path that is gated only by the victim opening the file. The CPE list confirms a broad, cross-platform blast radius across the Office servicing channels: Microsoft 365 Apps for Enterprise, Microsoft 365/Office 365 for Mac, Office LTSC 2021 and Office LTSC 2024, plus Office LTSC for Mac 2021 and 2024, i.e. both the subscription and perpetual (LTSC) branches on Windows and macOS. The provided CPE entries carry wildcard versions, so the intelligence set does not pin a discrete vulnerable build range; the authoritative build-and-channel version mapping is published in the Microsoft advisory. As a memory-safety bug in a ubiquitous desktop productivity application, it aligns with the classic Office document-borne RCE pattern: the exploitability constraint is user behavior and email/attachment security controls, not network reachability or privileges.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Document delivered over the network but opened by a user, so AV:N with UI:R and PR:N; memory-corruption RCE in the user context yields C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Word across Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Mac equivalents is affected by a high-severity remote code execution vulnerability that could let an attacker gain control of a system when a user opens a malicious document. Exploitation is unauthenticated but requires user interaction, and no public exploit identified at time of analysis, yet the ubiquity of Word in business workflows and the potential for data theft, system compromise, and operational disruption make this a priority for immediate patching. All organizations using these Office versions should act promptly to protect their users and data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
GitHub PoC
Exploit-DB