Microsoft Word EUVD-2026-99704

Exploitation requires the victim to open an attacker-crafted Microsoft Office Word document on the local system - the CVSS vector encodes this as AV:L with UI:R (mandatory user interaction). No authentication or elevated privileges are needed (PR:N), and the attack works against default Word configurations, but it is fundamentally limited by the need for social engineering to get a specific user to open a specific malicious file; it cannot be triggered remotely without that interaction and is not automatable at scale (SSVC Automatable=no). Successful exploitation yields code execution only in the context of the opening user, not inherently SYSTEM/admin.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High) describes a local, file-based attack requiring no privileges but mandatory user interaction - i.e. a victim must open a maliciously crafted Word document. The CISA SSVC framework aligns with a moderate posture: Exploitation=none (no observed exploitation), Automatable=no (each attack needs a user to open a file, so it cannot be mass-automated), but Technical Impact=total, consistent with the full C:H/I:H/A:H code-execution outcome. There is no CISA KEV listing and no POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied, so exploitation probability cannot be quantified from this input. The signals are internally consistent - there is no network-vs-local contradiction - and point to a classic weaponizable-document bug that is high-impact per-target but gated by user interaction and non-automatable, making it a patch-on-cycle priority rather than a drop-everything emergency, albeit one worth prioritizing given Word's enormous install base and its history as a phishing payload vector.

An attacker emails or otherwise delivers a crafted Word document (e.g. via a phishing lure) to a target. When the victim opens the file, the malformed content triggers a heap-based buffer overflow in Word's parsing code, allowing the attacker's code to run in the context of the logged-in user. No public exploit code is identified in the provided data, and the attack cannot succeed without the user opening the document.