Microsoft Word EUVD-2026-44196

Exploitation requires the victim to open or preview an attacker-crafted Word document on an unpatched Office/Microsoft 365 build (the UI:R user-interaction requirement is the primary limiting factor); no attacker authentication or prior privileges are needed (PR:N). The attack vector is local (AV:L) - the malicious file must be delivered to and processed on the target host (e.g., email attachment, download, or a SharePoint-hosted document), not triggered over a remote network service against a client. Impact is confined to the opening user's security context (S:U), so an attacker gains code execution at that user's privilege level, not automatic elevation. Protected View, Application Guard, or up-to-date patching each break the chain.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes the classic 'open a malicious document' pattern: local attack vector, no privileges required, but mandatory user interaction, with high impact to confidentiality, integrity, and availability limited to the current user's context (scope unchanged). This is not a wormable, remotely-triggerable RCE - the UI:R requirement and local vector meaningfully cap mass exploitation, which fits the absence of a KEV listing. No EPSS score and no SSVC decision data were provided in the input, so automatability and observed-exploitation signals cannot be independently weighed. No POC or active exploitation is indicated. Net: a genuine high-severity client-side RCE class that is a standard priority for Patch Tuesday remediation, but current signals point to phishing/social-engineering delivery rather than opportunistic mass exploitation. The SharePoint CPEs warrant attention - if the same parsing path is reachable server-side, the practical risk profile could be higher than the client-only reading; verify server exposure with the vendor advisory.

An attacker emails a crafted Word document (or hosts it on a shared/SharePoint site) and social-engineers the target into opening it; the malformed structure overflows a stack buffer in Word's parser and executes attacker-supplied code as the current user, enabling malware installation or credential theft. Given AV:L and UI:R, the attack hinges on delivery and convincing the victim to open the file rather than any network-service exploitation. No public exploit is currently identified, so an attacker would need to develop a working exploit for the specific overflow.