Microsoft Office EUVD-2026-44249

Exploitation requires a local user to actively open a specially crafted Office document on an affected installation - user interaction (UI:R) is mandatory and is the primary gating condition. The attack vector is local (AV:L), meaning the malicious file must be present and opened within a user session; remote exploitation via a network service is not applicable to this vulnerability. No system-level privileges are required of the attacker (PR:N), but the attacker must successfully deliver the crafted file to the victim's machine (e.g., via email attachment, download, or shared network path). Limiting factors include: the victim must choose to open the file, Protected View or Mark of the Web restrictions in Office may intercept untrusted files before they reach the vulnerable parser, and the flaw only affects unpatched builds across the confirmed version range. No default-configuration unauthenticated network path exists for this vulnerability.

Multiple risk signals converge on a moderate-to-low real-world priority. The CVSS 5.5 base score reflects a meaningful but bounded risk: local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), and mandatory user interaction (UI:R) - the victim must actively open a malicious file. Confidentiality impact is rated High (C:H) while Integrity and Availability are unaffected, meaning successful exploitation leaks memory but cannot execute code or corrupt data directly. EPSS is 0.39% at the 31st percentile, indicating low exploitation probability relative to the full CVE population. CISA SSVC independently rates Exploitation as none, Automatable as no, and Technical Impact as partial - all consistent with a file-borne, single-user-interaction flaw. No CISA KEV listing and no reported POC further reduce urgency. The primary risk is information disclosure enabling follow-on attacks (e.g., memory layout leakage assisting ASLR bypass in a chained exploit), not direct code execution. Organizations with high-value targets who receive untrusted Office documents (legal, finance, executive staff) should prioritize patching above the average.

An attacker crafts a malicious Office document (e.g., a .docx or .xlsx file with a manipulated field size in its binary structure) and delivers it to a target via email or a file-sharing link. The victim opens the file in an unpatched version of Microsoft Office, triggering the out-of-bounds read in the document parser, which leaks adjacent heap or stack memory contents. The leaked data could include sensitive in-memory values such as pointer addresses, helping an attacker defeat ASLR in a subsequent, more severe exploitation attempt. No public exploit code has been identified at time of analysis.