EUVD-2026-56691
GHSA-p392-rqwr-573j
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local document delivery requires user to open the file (UI:R, AV:L); opening Word requires no prior privilege (PR:N); full triad impact consistent with arbitrary code execution in user session.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AnalysisAI
Code execution in Microsoft Word stems from a numeric truncation error (CWE-197) in the document processing engine, affecting Word 2016, Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise. Exploitation requires a user to open a specially crafted document, after which an attacker can execute arbitrary code with full confidentiality, integrity, and availability impact under the victim's session. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog; however, Microsoft has confirmed and released a patch, indicating completed vendor triage.
Technical ContextAI
CWE-197 (Numeric Truncation Error) describes a class of defect where a value is converted from a larger numeric type to a smaller one, causing high-order bits to be silently discarded. In Microsoft Word's document parsing pipeline, this truncation likely occurs when processing a crafted record field - such as a malformed length, offset, or size value in a structured document format (e.g., OOXML or legacy binary .doc). The resulting data corruption can translate to a heap or stack memory corruption condition exploitable for arbitrary code execution. Affected products span multiple Office release trains sharing the core Word parsing library: Microsoft Word 2016 (CPE: cpe:2.3:a:microsoft:word:2016:*), Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Microsoft 365 Apps for Enterprise - all identified via ENISA EUVD-2026-56691.
RemediationAI
Apply the vendor-released patch immediately through Microsoft Update, the Microsoft Update Catalog, or your enterprise patch management tooling. For Microsoft Word 2016, the confirmed fixed build is 16.0.5565.1000 - upgrade to this build or later. For Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise, consult https://aka.ms/OfficeSecurityReleases to identify the correct patched build for your update channel, as channel-specific build numbers were not independently specified in the available data. The full Microsoft Security Response Center advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63525. If immediate patching cannot be completed, enforce Protected View for documents originating from external sources via Group Policy (User Configuration > Administrative Templates > Microsoft Word > Word Options > Security > Trust Center > Protected View) - this prevents automatic full document parsing on open and meaningfully reduces attack surface, though it introduces friction for users who regularly work with externally sourced files and does not constitute a complete mitigation.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-197 – Numeric Truncation Error
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today