Microsoft Office Word EUVD-2026-73817

Exploitation requires two concrete prerequisites: (1) the victim must open a specially crafted Word document using an unpatched installation of Microsoft Office Word (AV:L/UI:R), meaning the attacker must first deliver the malicious file to the target's filesystem via phishing, shared drive, USB, or another delivery mechanism; (2) the victim must actively open the file - passive or background processing is insufficient. No attacker privileges or authentication on the target system are required (PR:N). Exploitation is further limited by: the local attack vector (the attacker cannot remotely trigger disclosure without first landing a file); the confidentiality-only impact (no code execution or data modification occurs); and the SSVC Automatable: no determination, confirming this cannot be mass-exploited without per-target user interaction. Protected View, if enforced and not dismissed by the user, would block the vulnerable document rendering path.

The CVSS 3.1 score of 5.5 (Medium) is consistent with the actual threat profile: AV:L constrains exploitation to scenarios where the attacker can deliver a malicious document to the victim's local system, and UI:R mandates that the victim open that document. C:H is notable - the null termination flaw could expose sensitive in-process memory, potentially including document content, encryption keys, or user credentials resident in the Word process heap - but the local-only vector limits blast radius substantially compared to a network-exploitable disclosure. SSVC confirms Exploitation: none, Automatable: no, and Technical Impact: partial, reinforcing that this is not a high-urgency fire-drill item. No EPSS data was provided; no public POC and no CISA KEV listing are identified at time of analysis. Even a mid-sized IT operation should treat this as a routine patch-cycle item rather than emergency response, given the mandatory user interaction and local-only reach. The PR:N metric warrants attention: unlike privilege-escalation bugs, this flaw does not require the attacker to be an authenticated system user - an externally delivered malicious document is sufficient once it reaches the filesystem and is opened.

An attacker crafts a malicious Word document embedding a string or document element designed to trigger the null termination flaw and delivers it to a target via phishing email or a shared network location. When the victim opens the document with an unpatched version of Office Word, Word's string-handling code over-reads a buffer, and the attacker - if co-located on the same system or able to observe process memory output - can capture sensitive data such as document fragments or in-process credentials. No public proof-of-concept has been identified, which limits opportunistic use.