EUVD-2026-102463Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Word document to victim
-
ExploitVictim opens document in vulnerable Office
-
ExecutionTrigger numeric truncation / memory corruption
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Numeric truncation prevention
|
| Exploitation Conditions | Exploitation requires a victim to open an attacker-crafted Word document in a vulnerable build of Microsoft Office Word (Microsoft 365 Apps for Enterprise, Office LTSC 2021, or Office LTSC 2024), per the CVSS UI:R requirement - there is no automatic or zero-click vector in the available data. No authentication is required (PR:N), so the attacker needs no prior access, but the mandatory user interaction (opening/previewing the malicious file) is the primary limiting factor and means social engineering or file delivery is a prerequisite. A vendor patch is available, so patched systems are not exploitable. |
| Impact | This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity, unauthenticated code execution with high impact to confidentiality, integrity, and availability, tempered only by the User Interaction requirement (UI:R) - a victim must open a malicious Word document. The CWE-197 numeric truncation root cause is consistent with a memory-corruption path leading to arbitrary code execution. However, several key exploitation signals are MISSING from the input: there is no EPSS exploitation-probability score, no CISA KEV listing, and no indication of public POC/exploit code, so real-world exploitation likelihood cannot be quantified from this data. The vendor-provided patch raises the staks, since patch availability typically accelerates reverse-engineering and exploit development for ubiquitous Office targets. Net assessment: treat as a priority patch given the ubiquitous footprint and RCE impact, but note that the absence of EPSS/KEV/POC data means active exploitation is NOT confirmed - prioritization rests on impact and prevalence rather than observed exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malicious Word document that triggers the numeric truncation flaw and emails or otherwise delivers it to a target. When the victim opens the document in a vulnerable Office/Microsoft 365 Apps build, the truncation error corrupts memory and the attacker's code runs with the user's privileges. No public exploit code is identified at the time of analysis, so this scenario is inferred from the CVSS vector (UI:R, C:H/I:H/A:H) rather than an observed exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Code execution in Microsoft Word - across Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 - is achievable when a victim opens an attacker-crafted document containing a malformed numeric field that triggers an integer truncation flaw (CWE-197) inside the Word parsing path. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or prior access is needed, but successful exploitation is gated by mandatory user interaction: the target must open or preview a malicious file, so delivery depends on phishing, web download, or similar social-engineering vectors. At time of analysis there is no public exploit identified, and Microsoft has published a fix via its MSRC update guide, so fully patched installations are not exposed.
RemediationAI
Apply the vendor patch for CVE-2026-108451 as described in the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108451 - patch status is 'Patch available per vendor advisory,' and no explicit fix build number was included in the supplied data, so obtain the exact fixed build from that advisory and deploy it through Microsoft Update, Windows Update for Business, Microsoft Configuration Manager, or your Office Click-to-Run update channel; note that patched systems are not exploitable, making update the definitive fix. Where immediate patching is not possible, the critical compensating control is breaking the user-interaction precondition: enforce Protected View for files originating from the internet and for Outlook attachments, use Microsoft Defender Application Guard or Application Guard for Office to containerize untrusted documents, and disable Explorer preview panes and Outlook attachment preview so a malicious file is not parsed before the user consciously opens it - the trade-off is that Protected View and Application Guard add a visible 'Enable Editing' step and can block legitimate content from trusted-but-internet-sourced locations until users unblock it. Additional hardening includes the Attack Surface Reduction rule 'Block Office applications from creating child processes' (side effect: legitimate Word macros and add-ins that spawn processes will fail and may need exclusions) and 'Block Win32 API calls from Office macros,' plus enforcing Mark-of-the-Web propagation so downloaded documents inherit the untrusted zone. Email and web gateways should be tuned to strip or quarantine malformed Word attachments, but this is a detection-dependent layer and should not be relied on as a substitute for patching. Keep in mind there is no public exploit identified at time of analysis, so urgency is driven by the high CVSS impact (8.8, full confidentiality/integrity/availability within the Office process) rather than by observed exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is classified as CWE-197 (Numeric Truncation Error): a numeric value - such as a record length, offset, or size field embedded in a Word document structure - is converted to a narrower integer type, silently discarding high-order bits. Because the truncated value is subsequently used for buffer sizing, bounds checking, or pointer arithmetic during document parsing, an attacker who controls that field can force a length/size mismatch that leads to an out-of-bounds write or read inside the WINWORD.EXE process, ultimately yielding arbitrary code execution in the context of the victim user. The affected component is the Microsoft Office Word document parser rather than a remote service, which is why the CVSS vector requires user interaction (UI:R) while still scoring network attack vector (AV:N) and no privileges (PR:N). CPE data pin Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 as the impacted product families, so the flaw is present in the shipping Office codebase shared across the subscription and long-term servicing channels. Note that the supplied threat-intelligence tags include 'Authentication Bypass'; that label is inconsistent with both the described truncation defect and the assessed vector, which grants no authentication advantage to the attacker, so it should not be relied upon as an accurate characterization of this issue.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Document-delivered RCE: AV:N and PR:N since no auth is needed, UI:R because the victim must open the crafted file, and C/I/A:H for full code execution as the user.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity code execution flaw in Microsoft Word affects the organization's entire Word footprint - Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 - meaning nearly every knowledge worker who opens documents is potentially in scope. Exploitation requires a user to open or preview a specially crafted file, so the practical risk is a phishing- or download-delivered attack that could hand an intruder the victim's endpoint and credentials, though no public exploit has been observed and vendor fixes are already available. Leadership should treat this as a patch-cadence and email-security exposure issue rather than an imminent breach, prioritizing rapid update of the Office estate and reinforcement of user reporting of suspicious documents.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
GitHub PoC
Exploit-DB