Microsoft Word EUVD-2026-44184

Exploitation requires a victim to open or preview an attacker-crafted Word document in an affected Office/Word build - the CVSS UI:R flag confirms user interaction is mandatory, which is the primary limiting factor. No authentication or prior privileges are needed (PR:N), and attack complexity is low (AC:L), so any successfully opened malicious file can trigger the flaw against default configurations; there is no special product feature or non-default setting required beyond running an unpatched affected version. The attack vector is local (AV:L), meaning the file must reach and be opened on the target host (e.g., via email, download, or share) rather than being exploited remotely without interaction. For SharePoint SKUs, exposure additionally depends on server-side Office document-processing being in use.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High) describes a low-complexity flaw needing no privileges but requiring the victim to open a file - the classic 'send a document, user opens it' Office pattern, which is local vector but network-deliverable via email or download. High confidentiality, integrity, and availability impact reflect full code execution in the user's context. No EPSS score, SSVC decision, or KEV entry was provided, and no POC is referenced, so current signals point to a real but not-yet-actively-exploited risk. The broad affected footprint and the low exploitation complexity make this a meaningful patch priority for any environment running Office; however, the reliance on user interaction and the absence of known exploitation or public POC place it below actively-exploited zero-days in urgency. Note the tag list includes 'Denial Of Service' whereas the description and CVSS emphasize code execution - the code-execution characterization from Microsoft's own vector should be treated as primary.

An attacker emails a booby-trapped Word document (or hosts it for download) to a target and uses social engineering to get the victim to open it; when Word parses the file, the use-after-free is triggered and attacker-controlled heap data hijacks execution, running code in the victim's user context. No authentication or elevated privileges are needed, but the AV:L/UI:R vector means the victim must open the file. No public exploit is identified at time of analysis.