Microsoft Office EUVD-2026-44317

Exploitation requires the victim to actively open a specially crafted Office document on an affected, unpatched Microsoft Office installation - the CVSS AV:L/UI:R metrics confirm local attack vector and mandatory user interaction as hard prerequisites. The attacker does not need any privileges on the target system (PR:N), but must successfully deliver the malicious file and induce the victim to open it, making social engineering the primary attack enabler. Exploitation is constrained by: the non-automatable SSVC classification (no worm or drive-by network path exists); the local-only attack vector (no remote unauthenticated network exploitation path); and the absence of any known public exploit code. The vulnerability applies across Click-to-Run, MSI, and Mac deployment models on all affected builds prior to the patched versions. No special configuration, elevated feature flag, or non-default setting is required - any user who opens the crafted document on an unpatched build is at risk.

The CVSS 3.1 base score of 5.5 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H presents a notable internal discrepancy: the CVE description explicitly states 'disclose information' as the attacker outcome, yet the vendor-assigned CVSS records C:N (no confidentiality impact) and A:H (high availability impact). CWE-125 out-of-bounds reads are routinely associated with both information leakage and crashes, so the description may be capturing a secondary effect while the CVSS reflects the primary practical outcome - an application crash - but this has not been independently confirmed by a third-party advisory. CVSS indicates network access is not required (AV:L) and user interaction is mandatory (UI:R), which eliminates remote unauthenticated exploitation paths entirely. The EPSS score of 0.36% at the 28th percentile is very low, consistent with the CISA SSVC assessment of exploitation: none and automatable: no. No KEV listing exists, and no public exploit code has been identified. Despite an enormous product footprint covering virtually all enterprise Microsoft Office deployments, the combination of a local attack vector, required user interaction, sub-1% EPSS, and non-automatable SSVC classification makes this a lower-priority remediation item for most organizations absent specific threat intelligence indicating targeted use.

An attacker crafts a malicious Office document - such as a .docx, .xlsx, or .pptx file - containing specially structured binary or XML data designed to trigger the out-of-bounds read in Microsoft Office's document parsing engine. The victim is socially engineered into opening the file locally (via phishing email or malicious download), at which point the parser reads beyond its allocated buffer, either leaking adjacent process memory or crashing the Office application. No public exploit code has been identified at time of analysis, and the requirement for user interaction limits this to targeted delivery rather than automated mass exploitation.