Microsoft Office EUVD-2026-44217

Exploitation requires that a target user locally open a specially crafted Office document - user interaction (UI:R) is mandatory and cannot be bypassed remotely. The attack vector is local (AV:L), meaning the malicious file must already be present on or delivered to the target system; direct network-based exploitation without file delivery is not possible. No authentication or elevated privileges are required from the attacker's perspective (PR:N), but the attacker must successfully socially engineer the target into opening the file. Impact is limited to low confidentiality disclosure (C:L); no integrity or availability impact is possible from this vulnerability. Exploitation is further constrained by the non-automatable SSVC rating, meaning mass automated exploitation is not feasible. Protected View or Application Guard configurations in Office would block the vulnerable code path for documents from untrusted sources.

All available signals converge on very low real-world risk. CVSS 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a local, low-complexity attack requiring user interaction with impact limited to partial confidentiality loss. EPSS scores this at 0.36% exploitation probability in the 28th percentile, consistent with a low-severity information-disclosure class that rarely attracts weaponization effort. SSVC explicitly rates exploitation as none, automatable as no, and technical impact as partial - all low-tier signals. The vulnerability is not listed in CISA KEV and no POC has been identified. The one potential amplifier is product prevalence: Microsoft Office is ubiquitous, meaning the absolute number of potentially exposed endpoints is large even when individual risk is low. However, the attack's requirement for local file execution and user interaction creates a meaningful barrier to mass exploitation. There are no conflicting signals between data sources.

An attacker sends a target a malicious Office document - via email attachment, shared drive, or web download - crafted to trigger an out-of-bounds read in the Office parser. When the victim opens the file, the parser reads beyond a buffer boundary and exposes a small region of process memory, which the attacker could potentially extract through a side channel embedded in the document's output behavior. No public POC exists; the CVSS local vector means this scenario requires the attacker to get the file onto the target system and have the user open it, limiting scalability compared to network-exploitable flaws.