Microsoft Office EUVD-2026-29712

Exploitation requires local access to a system running an affected build (Office LTSC for Mac 2021/2024 or Excel/Word for Android below the fixed versions) - the vector is AV:L, so it is not remotely reachable over a network. Within that constraint no privileges (PR:N) and no user interaction (UI:N) are needed. Limiting factors: the attacker must already have a local foothold on the device, only the listed macOS and Android Office products are affected (Windows Office is out of scope), and a pre-fix version must be installed; patched builds close the vector entirely.

The signals are consistent and point to modest real-world urgency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N, base 7.7) indicates local exploitation requiring no privileges and no user interaction, with high confidentiality and integrity impact and no availability impact. CISA SSVC reinforces low priority: Exploitation=none and Automatable=no, though Technical Impact=total. EPSS is 0.04% (13th percentile), there is no KEV listing, and no public exploit is identified, so this is not a mass-exploitation candidate. One conflict worth flagging: the human-readable description labels the impact 'spoofing,' yet the CVSS vector encodes C:H/I:H (total technical impact) - the 7.7 score is driven by that C:H/I:H rating, so treat the 'total impact' framing as broader than the plain 'spoofing' label and verify the concrete impact against Microsoft's advisory before prioritizing.

An attacker able to act locally on a device running a vulnerable Office build manipulates an Office document so that its content or source is presented to the victim as legitimate, exploiting the improper access-control check to spoof trusted content. Per the CVSS vector no elevated privileges or user interaction are required. No public proof-of-concept exists at time of analysis.