Microsoft Word EUVD-2026-99050

Exploitation requires the victim to open an attacker-crafted Microsoft Word document; the 'network' vector reflects delivery of that file (e.g. email attachment, web download, or file share) rather than a remotely reachable service. The mandatory user interaction (UI:R) is the primary limiting factor - no exploitation occurs without the user opening the malicious document. No authentication is required of the attacker (PR:N), and default Office configurations are affected. Impact is limited to information disclosure of process memory; there is no code execution, data modification, or availability impact. Affected builds include Office LTSC 2021 (<16.0.14334.20974), Office LTSC 2024 (<16.0.17932.21056), and Microsoft 365 Apps for Enterprise prior to the patched release.

This is a genuine but moderate-priority issue, not a top-tier emergency. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) tells a consistent story: an unauthenticated attacker can reach the flaw over a network, but only if a victim opens a crafted document (UI:R), and the impact is confined to confidentiality (C:H, I:N, A:N) - an out-of-bounds read leaking memory, not code execution or tampering. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis; this should not be treated as actively exploited. The required user interaction and information-disclosure-only impact meaningfully lower real-world risk versus the raw 6.5, though Word's enormous install base raises aggregate exposure. One minor tension to verify: the description calls the attacker 'unauthorized' and 'over a network,' while UI:R means a user must actually open the malicious file - the network vector reflects document delivery (email/web), not a listening service. The 'Buffer Overflow' tag is also imprecise for what is an out-of-bounds READ (disclosure), not an overflow write.

An attacker emails a specially crafted Word document (or hosts it on a web/file share) to a target. When the victim opens the file, Microsoft Word performs an out-of-bounds read while parsing malformed input, exposing adjacent process memory that may contain sensitive data. No public exploit code is identified at time of analysis, and successful exploitation hinges entirely on the victim opening the attacker-supplied document.