Microsoft Word EUVD-2026-73401

Exploitation requires an authenticated local session on an affected Windows host (PR:L, AV:L). The attacker must be able to open or cause Word to process a crafted document - achievable by any low-privileged user account with access to the application. No special non-default configuration is required beyond having Microsoft Office Word installed and running on an affected Windows build. Limiting factors: AV:L means no remote unauthenticated exploitation; I:N and A:N mean there is no write primitive or denial-of-service capability; S:U means no lateral movement through scope change. The primary constraint is the requirement for an existing local authenticated session.

Real-world risk is moderate. CVSS 5.5 (medium) accurately reflects a locally-bounded, confidentiality-only flaw with low-privilege prerequisites - not an internet-facing threat. EPSS data is absent from the provided input, so exploitation probability cannot be quantified; however, no CISA KEV listing and no public POC mean this does not currently meet criteria for emergency remediation. SSVC signals: exploitation status is 'none' (no KEV/POC), automatable is 'no' (AV:L, requires local session), technical impact is 'partial' (C:H but I:N/A:N). The 'Denial Of Service' tag in the input is contradicted by the CVSS vector (A:N) and description (information disclosure) - this tag is mislabeled. The mismatch between 'Microsoft Office Word' in the description and the Windows platform version strings in EUVD affected versions introduces uncertainty about whether patching Word via Office Update or Windows Update is the correct remediation path; defenders should apply both channels.

A low-privileged local user on an unpatched Windows system opens a specially crafted Word document that triggers a use-after-free condition in the document-processing code path. The freed heap memory, which may contain cached credential fragments, document contents, or other sensitive in-process data, becomes readable before it is overwritten, and the attacker reads the disclosed contents. No public exploit code exists at time of analysis, so this scenario requires bespoke exploitation knowledge.