EUVD-2026-102461Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Word document
-
DeliveryDeliver via phishing email or link
-
ExploitVictim opens file in Office Word
-
ExecutionTrigger heap buffer overflow in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open an attacker-crafted Word document in a vulnerable build of Microsoft Office Word (CVSS UI:R) - this user-interaction requirement is the primary limiting factor and means the flaw cannot be triggered purely remotely without victim action. No authentication or elevated privileges are needed (PR:N), and attack complexity is low (AC:L), so no special target-side configuration is required beyond running an unpatched Word. Affected deployment modes per the CPE data include Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and their macOS equivalents (Office 365 for Mac, Office LTSC for Mac 2021/2024), indicating both Windows and macOS Office installations are in scope. Code executes in the security context of the user who opens the document, so running as a low-privileged/standard user limits the immediate blast radius. |
| Impact | This is a genuine high-priority vulnerability, though not quite drop-everything-tonight. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, unauthenticated, low-complexity code execution with full confidentiality, integrity and availability impact - the only brake is UI:R, meaning a victim must open a malicious Word document. This is the classic Office client-side RCE profile, which attackers reliably convert into real-world compromise via phishing because the user-interaction requirement is cheap to satisfy at scale. Signals NOT present in the input temper the urgency: there is no CISA KEV listing, no EPSS probability score, and no evidence of public exploit code, so there is currently no public exploit identified at time of analysis. The absence of EPSS data means the quantitative exploitation-likelihood signal is simply missing and cannot be weighed - do NOT read its absence as 'low risk.' No SSVC decision data was supplied. Net: a credible, patch-now-class issue for any environment running Microsoft Office, driven by product ubiquity and the ease of phishing delivery rather than by any confirmed active-exploitation signal. |
| Exploit ScenarioDerived | An attacker emails a weaponized .doc/.docx file (or hosts it on a link) and lures a target into opening it in a vulnerable build of Microsoft Office Word. Parsing the malformed document triggers the heap-based buffer overflow (CWE-122), letting the attacker execute arbitrary code in the context of the user who opened the file. No public exploit code is identified at time of analysis, but the attack complexity is low (AC:L) and such Office-document RCEs are historically trivial to weaponize for phishing campaigns. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Remote code execution in Microsoft Office Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS builds) allows an unauthenticated attacker to run arbitrary code in the security context of a victim who opens a specially crafted document. The flaw is a heap-based buffer overflow reachable over the network, and because it requires only low attack complexity and no privileges (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), the sole barrier to exploitation is the user-interaction requirement - the victim must open the malicious Word file, which is the primary limiting factor. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status, but Microsoft has published a vendor patch, so this should be treated as a genuine high-priority, patch-now item rather than an emergency.
RemediationAI
Patch availability is confirmed by the vendor: apply the Microsoft security update for CVE-2026-108449 as documented in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108449 - this is the primary and preferred remediation. Note that the advisory does not publish a discrete fixed build number in the supplied data, so administrators should rely on the MSRC guidance and their standard update channel (Microsoft 365 Apps update channel, Office LTSC update, or Microsoft AutoUpdate for macOS) rather than targeting a specific version string; the patch reference is tagged as coming directly from the vendor. Until every in-scope client is updated, layer compensating controls that break the user-interaction trigger. Enable Protected View for files originating from the internet and enforce Mark-of-the-Web so downloaded documents open in a restricted sandbox - the trade-off is added friction and occasional rendering/compatibility prompts for legitimate documents. Where licensing and hardware permit, enable Microsoft Defender Application Guard for Office, which opens untrusted files in a disposable Hyper-V container so a successful overflow cannot reach the host - this costs additional memory and CPU, requires Windows Enterprise/Education and supported hardware, and is not available for macOS. Consider gateway or email filtering that blocks or quarantines high-risk Word formats and legacy containers (for example RTF and macro-enabled or legacy .doc files) if they are not business-essential, with the trade-off that some external partners may still send these formats and legitimate documents may be delayed. Attack Surface Reduction rules that block Office applications from creating child processes and from creating executable content can disrupt post-exploitation stages but will not prevent the memory-corruption primitive itself, and should be audited in blocking mode first to avoid breaking line-of-business macros. Finally, ensure Word runs under standard, non-administrative user accounts, since code executes with the opening user's privileges and least privilege directly limits the damage from a successful exploit.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-122, a heap-based buffer overflow, in the code Microsoft Word uses to parse document content. Rather than a stack overwrite, the corruption occurs in dynamically allocated (heap) memory, which typically allows an attacker who controls the document's contents to overwrite adjacent heap structures and ultimately redirect execution flow to attacker-supplied code. The network attack vector (AV:N) reflects that the malicious document is delivered remotely - via email attachment, download, or shared link - while the user-interaction component (UI:R) reflects that Word must actually parse the file before the overflow triggers; no credentials or elevated privileges are needed (PR:N) and no special target configuration is required (AC:L). The CPE data shows the affected code base spans both Windows and macOS installations: Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 and LTSC 2024, and Microsoft Office LTSC for Mac 2021 and 2024 - consistent with a shared document-parsing component rather than a platform-specific defect. Because code executes in the context of the user who opens the document, impact is bounded by that user's privileges; a standard, non-administrative account materially limits the blast radius.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious document is delivered over the network (AV:N) and needs only the victim to open it (UI:R, PR:N, AC:L); memory-corruption RCE yields full C/I/A in the user's context (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Office Word (including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and macOS builds) contains a high-severity remote code execution vulnerability that an unauthenticated attacker can trigger when a victim opens a specially crafted document. While no public exploit identified at time of analysis, the flaw allows arbitrary code execution in the victim's security context, posing a significant risk to organizational data and systems given Word's widespread use. Leadership should prioritize patching because a successful exploit could lead to data breach, ransomware deployment, or lateral movement, though the required user interaction lowers the immediate likelihood of mass exploitation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
GitHub PoC
Exploit-DB