EUVD-2026-29711
GHSA-vvc2-cg8v-mmjx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Office document
-
DeliveryDeliver via phishing or file share
-
ExploitVictim opens file in vulnerable Office
-
ExecutionTrigger heap buffer overflow in parser
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied, specially crafted Office file (UI:R) on a locally running vulnerable build - Office LTSC for Mac 2021/2024 below 16.109.26051019 or Office for Android below 16.0.19822.20190. No prior authentication or privileges on the target are needed (PR:N), and attack complexity is low (AC:L). The primary limiting factors are the mandatory user interaction (the file must be opened) and the local attack vector (AV:L) - there is no remote, interaction-free path; delivery depends on social engineering, and only the specified macOS LTSC and Android editions are in scope, not all Office platforms. |
| Impact | Signals are consistent and point to a genuine-but-not-urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 High) reflects low complexity and no privileges required but mandates local access and user interaction, so it is not a wormable network bug. EPSS is very low (0.06%, 18th percentile) and CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no' - both aligning with a 'no public exploit identified' status - while Technical Impact is 'total,' matching the C:H/I:H/A:H impact metrics. There is no conflict between sources here: high severity is driven by impact, not by ease or evidence of exploitation. The realistic risk is a targeted phishing/malicious-document scenario, not mass exploitation. Note PR:N here means no privileges on the target, but exploitation still hinges entirely on the victim opening a file (UI:R), which is the true limiting factor. |
| Exploit ScenarioDerived | An attacker emails or shares a specially crafted Office document (e.g., via phishing or a messaging app on Android/macOS). When the victim opens it in a vulnerable Office build, the malformed content triggers a heap-based buffer overflow in the parser, executing attacker code with the victim's privileges. No public exploit is currently identified, and the low complexity (AC:L) means a working exploit, once developed, would be reliable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Local code execution in Microsoft Office (LTSC for Mac 2021/2024 and Office for Android) via a heap-based buffer overflow (CWE-122) that an unauthorized attacker triggers when a victim opens a maliciously crafted document, yielding full confidentiality, integrity, and availability impact in the user's context. Exploitation requires user interaction (UI:R) and local access (AV:L), so weaponization depends on social engineering rather than remote reachability. This is no public exploit identified at time of analysis, with a very low EPSS score of 0.06% and CISA SSVC rating exploitation as 'none', indicating no observed activity despite the 'total' technical impact.
RemediationAI
Vendor-released patch: update to the fixed builds listed by Microsoft - Office LTSC for Mac 2021 and 2024 to 16.109.26051019 or later, and Office for Android to 16.0.19822.20190 or later - per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42831. Because exploitation requires a user to open a crafted file, effective compensating controls where patching lags include enforcing Protected View / blocking documents originating from the internet or email, disabling automatic content and macro/active-content rendering, and user awareness training to avoid opening untrusted Office files; the trade-off is reduced convenience and possible workflow friction when legitimately handling external documents. Also consider mail-gateway and EDR file-attachment scanning to reduce delivery of malicious documents.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-122 heap-based buffer overflow, a memory-corruption class in which attacker-controlled input written to a heap allocation exceeds the buffer boundary, overwriting adjacent heap metadata or object data and enabling control-flow hijack or arbitrary code execution. The affected component is Microsoft Office's document/file parsing logic, reachable when Office renders a specially crafted file. Per the CPE data the vulnerable code ships in cpe:2.3:a:microsoft:microsoft_office_for_android, microsoft_office_ltsc_for_mac_2021, and microsoft_office_ltsc_for_mac_2024, meaning this is cross-platform (Android and macOS) rather than a Windows-only issue, consistent with shared cross-platform Office parsing code.
Know when Microsoft Office Ltsc For Mac 2021 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by the user, so AV:L and UI:R; no privileges needed (PR:N) and memory corruption grants full C/I/A in the user context.
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Articles & Coverage 1
Executive ViewAI
A vulnerability in Microsoft Office for Mac (LTSC 2021/2024) and Android could enable unauthorized access to sensitive data and device compromise if users open malicious files. Despite high technical severity, no public exploit identified at time of analysis, and the required user interaction and local-only attack scope substantially reduce near-term risk. Organizations should apply the available patch within standard maintenance windows.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Information disclosure in Microsoft Office Word and related Microsoft 365/SharePoint products exposes sensitive memory c
Exploit-DB