EUVD-2026-56427
GHSA-f3j3-3cj6-g888
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-based command injection triggered solely by victim opening a document; no attacker system privileges required; user interaction is mandatory; scope unchanged with full user-level C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to execute code locally.
AnalysisAI
Command injection in Microsoft Office enables local arbitrary code execution with high impact across confidentiality, integrity, and availability, affecting Microsoft 365 Apps for Enterprise, Office 2019, LTSC 2021, and LTSC 2024. Exploitation requires a victim to open a specially crafted Office document, after which unsanitized input reaches a command processor without requiring any attacker-side privileges on the target system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to have one of the affected Office product versions installed - Microsoft 365 Apps for Enterprise 16.x, Office 2019 19.x, LTSC 2021 16.x, or LTSC 2024 16.x - and to actively open or interact with a malicious Office document (UI:R, user interaction is the critical trigger). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H presents a nuanced risk profile: the local attack vector and required user interaction constrain opportunistic remote exploitation, but the low complexity and absence of any privilege requirement on the attacker's part mean that once a malicious document reaches a user, the exploit path is straightforward. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious Office document embedding command injection payloads in a field or structure processed by a vulnerable Office subsystem, then delivers it to a target via phishing email, file share, or web download. When the victim opens the file, Office processes the embedded content and passes unsanitized data to a local command handler, executing arbitrary commands in the victim's user context. … |
| Remediation | Apply the security updates for all affected Office product lines through the Microsoft Security Release Center at https://aka.ms/OfficeSecurityReleases; the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65656 provides the authoritative patch guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Issue a security advisory restricting opening of Office documents from untrusted sources, enable EDR alerting for suspicious Office process execution, and convene security leadership to assess organizational exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today