Microsoft Word EUVD-2026-44201

Exploitation requires the victim to open a maliciously crafted Word document in an affected Office/SharePoint build - the user-interaction (UI:R) step is the primary gate, and no attacker authentication is needed (PR:N). What limits it: the attack is local/client-side (AV:L), so the attacker must deliver the file and rely on the user opening it outside Protected View; sandboxing (Protected View, Application Guard) or ASR child-process rules blunt code execution. There is no network-service-facing exposure - a server won't be compromised merely by receiving the file, only by a user opening it in a vulnerable client.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a classic client-side RCE: no privileges needed but the victim must open a file, and impact to confidentiality, integrity, and availability is High within an unchanged scope. There is no EPSS score, no POC, and no KEV listing in the provided data, so exploitation likelihood signals are absent - this reads as a real but not yet weaponized priority. The 'Local' attack vector reflects that the malicious file must reach and be opened by the user rather than any lack of remote deliverability (documents are routinely delivered by email/web), so realistic risk for phishing-driven campaigns is meaningful. Note a data conflict: the intelligence Tags include 'Authentication Bypass,' which does not match a double-free code-execution CWE - treat that tag as likely mislabeled and rely on the CWE-415/RCE description.

An attacker emails a weaponized Word document (or hosts it on a SharePoint/web link) to a targeted user; when the victim opens it, the double-free corrupts heap memory and executes attacker-controlled shellcode in the user's Office context, giving foothold for further malware or lateral movement. Because AC:L, exploitation is reliable once triggered, but UI:R means the campaign depends on social engineering to get the file opened. No public exploit code has been identified at time of analysis.