What is the CVSS score of EUVD-2026-44185?

EUVD-2026-44185 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Microsoft Word are affected by EUVD-2026-44185?

Microsoft Office products including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and SharePoint Server are affected by a code execution vulnerability in Word document parsing that executes…. A patch is available.

How to fix or mitigate EUVD-2026-44185?

Within 24 hours, inventory all Microsoft Office, Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and SharePoint Server 2016/2019/Subscription Edition deployments; assess deployment scope and communicate patch requirements to stakeholders. Within 7 days, deploy the vendor-released patch to a designated test environment, validate compatibility with business-critical line-of-business applications and workflows, and establish production rollout schedule. Within 30 days, complete patch deployment across the entire Microsoft Office footprint, prioritizing Microsoft 365 Apps and LTSC versions, followed by legacy editions and SharePoint Server instances.

Microsoft Word EUVD-2026-44185

| CVE-2026-55033 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-07-14 microsoft

GHSA-v79p-vgmv-rcc2

Buffer Overflow Integer Overflow Microsoft Microsoft Sharepoint Enterprise Server 2016 Microsoft Sharepoint Server 2019 Microsoft Sharepoint Server Subscription Edition Microsoft 365 Apps For Enterprise Microsoft Office Ltsc 2024 Microsoft Office 2019 Microsoft Office Ltsc 2021 Microsoft Office Ltsc For Mac 2021 Microsoft Office Ltsc For Mac 2024 Microsoft Word 2016 Microsoft Office 365 For Mac

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

vuln.today AI

7.8 HIGH

File must be opened by the victim so AV:L and UI:R; no auth needed (PR:N), low complexity (AC:L), and code execution yields full C:H/I:H/A:H in the user's context.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:30 vuln.today

CVE Published

Jul 14, 2026 - 17:08 nvd

HIGH 7.8

DescriptionCVE.org

Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer overflow in the file-parsing path, letting an attacker who convinces a victim to open a crafted document run arbitrary code with the victim's privileges. It affects a broad Office footprint including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, the macOS editions, and SharePoint Server 2016/2019/Subscription Edition. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 7.8 CVSS and Word's ubiquity make it a routine priority patch.

Technical ContextAI

The root cause is CWE-190 (integer overflow or wraparound), a class where an arithmetic operation - typically a length, count, or size calculation during document parsing - exceeds the storage width and wraps to a small or negative value, causing an undersized allocation followed by an out-of-bounds write (the tags also cite Buffer Overflow, consistent with an overflow-driven heap/buffer corruption). The affected technology is the Office rich-text/Word document rendering engine shared across the Click-to-Run Microsoft 365 Apps for Enterprise, MSI-based Office 2019 and Office LTSC 2021/2024, the Office for Mac builds, and the SharePoint server-side Office rendering stack. CPE data confirms the vulnerable code is present in both desktop Office (Windows and macOS) and server-side SharePoint (Enterprise Server 2016, Server 2019, Subscription Edition), meaning the same parsing flaw is reachable wherever Word-format content is processed.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55033, which lists the exact patched builds per channel (the provided data confirms a fix is available but does not carry a specific version string, so pull the precise KB/build from that advisory). For Click-to-Run Microsoft 365 Apps and Office for Mac, ensure automatic updates are enabled or push the current channel build; for MSI Office 2019 and Office LTSC, deploy the corresponding monthly security update; for SharePoint Server 2016/2019/Subscription Edition, apply the server-side Office update and restart affected services. As compensating controls until patched, open untrusted documents in Protected View / Application Guard to sandbox the parser (trade-off: users may disable it for editing), block or quarantine inbound Office attachments from untrusted senders at the mail gateway (trade-off: may delay legitimate documents), and restrict macro/content by policy - noting these reduce but do not eliminate exposure since the flaw is in document parsing itself, not macros.