Microsoft 365 Apps For Enterprise EUVD-2026-22631

Local attacker with no privileges must execute code on the target system running Microsoft Office Word. The vulnerability is triggered during document parsing; victim interaction (opening a crafted .docx or .doc file) is required.

Real-world risk is moderate despite the 8.4 CVSS score. The vulnerability requires local access (AV:L), significantly reducing the attack surface compared to network-based threats-attackers must already have foothold on the target system or convince users to execute malicious files locally. SSVC framework rates this as non-automatable with total technical impact but no confirmed exploitation, indicating theoretical severity without observed in-the-wild abuse. The PR:N (no privileges required) and UI:N (no user interaction) ratings elevate concern within local attack scenarios, as any local process could potentially trigger exploitation without user awareness. However, absence from CISA KEV and lack of public exploit code suggest limited adversary interest to date. Microsoft's patch availability mitigates risk for organizations with timely update deployment. Priority should be medium for most organizations-higher for environments where untrusted local users have access or where sophisticated adversaries target document processing workflows. The authentication bypass tag suggests potential privilege escalation from local user to SYSTEM context.

An attacker with local system access crafts a malicious Word document containing specially formatted structures that manipulate pointer references during document parsing. When the victim opens the document or when Word's background indexing processes the file, the untrusted pointer dereference triggers, allowing the attacker to redirect program execution flow to arbitrary memory locations containing malicious code. The attacker achieves code execution with the privileges of the Word process, potentially escalating to full system compromise without requiring user interaction beyond the initial file placement.