EUVD-2026-102459Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Word document via phishing
-
DeliveryVictim opens malicious file
-
ExploitTrigger heap overflow in Word parser
-
ExecutionExecute arbitrary code as user
-
ImpactInstall payload or move laterally
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or preview a specially crafted Word document in an affected build of Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, or Microsoft Office LTSC 2024 (per CVSS UI:R). The attacker needs no authentication and no prior privileges on the target (PR:N), and the document can be delivered remotely over email or the web (AV:N) against default Office configurations. The principal limiting factor is the required user interaction - the exploit does not fire without the user opening the malicious file - and code executes only in the context of the logged-in user, not inherently as SYSTEM/admin. |
| Impact | This is a genuine patching priority, not a high-CVSS-but-low-real-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes the classic weaponized-Office-document pattern: a remote, unauthenticated attacker needs no privileges, faces low attack complexity, and achieves full C:H/I:H/A:H impact. The only meaningful gate is UI:R - the victim must open or preview a malicious Word file. No EPSS score, KEV listing, SSVC decision data, or POC indicator was supplied in the input; absence of a KEV flag means there is no confirmed active exploitation, and absence of a POC flag means no public exploit code is referenced. However, heap-based buffer overflows (CWE-122) in Office file parsers are historically a favored target for phishing-delivered RCE, and the CVSS network vector is fully consistent with the description of code execution over a network via a crafted document. The dominant residual risk-lowering factor is the required user interaction; the dominant risk-raising factor is the ubiquity of Office and the ease of delivering documents by email. Net: high real-world risk, bounded primarily by the need to trick a user into opening a file. |
| Exploit ScenarioDerived | An attacker emails a victim a specially crafted Word document (or hosts it on a web/file share) and lures them into opening it, perhaps via a phishing pretext. On open, the malformed document triggers a heap-based buffer overflow in Word's parser, allowing arbitrary code execution in the context of the user. No public exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Remote code execution in Microsoft Word affects Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, where a crafted document triggers a heap-based buffer overflow and lets an unauthenticated attacker run code in the context of the victim. Exploitation is network-delivered (email or web) but requires the user to open or preview the malicious file (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R); no elevated privileges are needed on the target. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch per its advisory; the severity and default-configuration reachability make this a real patching priority despite the user-interaction dependency.
RemediationAI
Patch status: vendor-released patch available per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108447. Microsoft 365 Apps for Enterprise customers should move to the current build through their normal update channel (Monthly Enterprise, Current, or Semi-Annual as applicable); Office LTSC 2021 and LTSC 2024 customers should apply the corresponding monthly security update from the Update Guide. Because exploitation requires the user to open or preview a crafted document, compensating controls can reduce exposure while updates roll out, but each has trade-offs: keep Protected View and Application Guard for Office enabled for files from the internet and email (they add friction and can break some legitimate document workflows), enforce Office File Block and mail-gateway attachment filtering/sandboxing for untrusted Word documents (may delay or reject legitimate attachments), disable the Outlook reading/preview pane for untrusted senders (changes user experience), and deploy Exploit Protection mitigations such as Export Address Filtering and Heap Integrity Termination for WINWORD.EXE (rarely, these can cause compatibility issues with add-ins). Running Office as a standard user rather than a local administrator limits post-exploitation impact but does not prevent the initial overflow. None of these controls replaces the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a heap-based buffer overflow (CWE-122) in Microsoft Word's document parsing/rendering path. When Word opens a specially crafted file, data written past the end of a heap-allocated buffer corrupts adjacent heap metadata and objects; in an Office process this can be steered into controlled memory writes and, ultimately, arbitrary code execution under the user's security context. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates the attack is network-reachable with low complexity and no authentication or prior privileges, but the UI:R metric shows the victim must open or preview the document, and the unchanged scope means code execution is bounded by the Office process's privileges rather than automatically escalating to SYSTEM. CPE data confirms the vulnerable code ships in Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, all of which share the Word parsing engine; the CPE version fields are wildcards, so the defect affects unpatched builds across those product families.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted document delivered remotely (AV:N) with no auth (PR:N) but requires the user to open it (UI:R); heap-overflow RCE in user context yields full C/I/A impact, scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity remote code execution flaw in Microsoft Word affects the organization's Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 deployments, allowing an attacker to execute code on a victim's workstation simply by getting them to open or preview a malicious document delivered by email or web. Because the flaw is reachable in default configurations and can run code without any credentials, any employee who handles documents is a potential entry point. Leadership should treat this as a priority patching item: a single successful lure can hand an attacker a foothold on an end-user device inside the corporate network.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
GitHub PoC
Exploit-DB