Microsoft Office EUVD-2026-44158

Exploitation requires a user to open or preview an attacker-crafted Office file in a vulnerable Office build (Microsoft 365 Apps, Office 2016/2019, or Office LTSC 2021/2024); the CVSS UI:R metric confirms victim interaction is mandatory, which is the key limiting factor. No attacker authentication or pre-existing privileges are needed (PR:N), and the attack executes in the local context (AV:L) of the opening user. Limiting factors that reduce realistic risk: the requirement for user interaction, execution only in the current user's (non-elevated) context under S:U, and mitigation by Protected View / File Block policies which sandbox or prevent untrusted documents from reaching the vulnerable parser.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a local vector requiring user interaction but no privileges, with high impact across all three security properties - the classic 'open a malicious document' profile. PR:N with UI:R means no attacker authentication is needed, but a human must open the file, which is the primary limiter on automatability and mass exploitation. No EPSS score was supplied, the CVE is not in CISA KEV, and no POC is referenced, so real-world exploitation signals are currently absent; this is a high-severity-by-impact but not-yet-proven-exploited issue. Given Microsoft Office's enormous install base and the recurring history of Office document parsers being weaponized via phishing, the realistic priority remains high despite the missing exploitation telemetry - treat the absence of KEV/POC data as unconfirmed rather than as evidence of low risk.

An attacker emails a victim a crafted Office document (e.g., via a phishing lure) that, when opened, overflows a heap buffer in Office's file parser and executes attacker code with the victim's privileges. Because the vector is local with required user interaction (AV:L/UI:R), the attack hinges on social engineering to get the file opened rather than any remote network exposure. No public POC is currently identified, so exploitation would require the attacker to independently develop a working heap-overflow exploit.