Microsoft Office Word EUVD-2026-73475

User interaction is required: the victim must actively open a malicious Word document (UI:R per CVSS). No attacker authentication or special privileges are required (PR:N). The document is delivered over the network - via email attachment, web download, or file share - making phishing the primary delivery mechanism. Attack complexity is low (AC:L), meaning no race condition, heap-spray precision, or special timing is required beyond document delivery. Exploitation is bounded by the requirement for user interaction: recipients who do not open the malicious file are not at risk. Environments enforcing Protected View for externally sourced documents, disabling document preview in mail clients, and applying ASR rules reduce the attack surface but do not constitute a full mitigation.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately characterizes the attack profile: no attacker authentication, low complexity, broad network delivery, limited only by the need for a victim to open a document. No EPSS score was provided, the CVE has not been added to CISA KEV, and no public exploit code has been identified, placing this in the category of unconfirmed-exploitation high-severity vulnerabilities. Absent KEV or POC signals, the real-world urgency is driven primarily by the product's near-universal enterprise deployment and the historical frequency with which threat actors weaponize Office document flaws - even a mid-sized municipal IT team in kielce should treat this as a priority patch-cycle item given the low attack complexity and broad victim population. An unresolved data quality concern - EUVD version data listing Windows OS builds rather than Office versions - means authoritative affected-product scope requires verification against the MSRC advisory before scoping patch efforts.

An attacker crafts a malicious Word document with a specially structured field or binary record that triggers the heap overflow during parsing, then delivers it to a target via a phishing email. The victim opens the attachment in Microsoft Office Word, the parser processes the oversized data, overwrites heap control structures, and redirects execution to attacker shellcode, giving the attacker full control of the victim's session. No public exploit code has been identified at time of analysis.