Microsoft Word EUVD-2026-99715

Exploitation requires the victim to open an attacker-supplied crafted Word document (CVSS UI:R) - there is no server-side or zero-click network path despite the AV:N rating, because 'network' here refers to remote delivery of the malicious file, not a listening service. No authentication or prior privileges are needed on the target (PR:N), and default Office Word configurations are affected across the listed Windows and Mac builds. The principal limiting factors are: mandatory user interaction (the file must be opened, and Protected View / Mark-of-the-Web warnings or disabled macros may interpose a prompt), that code runs only in the opening user's context (S:U, no privilege escalation), and that SSVC marks the attack non-automatable, so mass/wormable exploitation is not feasible.

Signals are moderately but not maximally aligned. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H, 8.8 HIGH) describes a classic weaponized-document memory-corruption bug: no privileges needed, low complexity, but mandatory user interaction (UI:R) - the victim must open a crafted Word file. This UI:R requirement is the single most important risk-dampening factor and is corroborated by CISA SSVC, which rates Exploitation as 'none' (no public exploit identified at time of analysis) and Automatable as 'no' (consistent with a flaw that cannot be sprayed at scale because it needs a human to open an attachment). Technical Impact is 'total,' matching the C:H/I:H/A:H full compromise of the user context. The vulnerability is NOT in CISA KEV, and no POC is indicated, so there is no evidence of active exploitation. EPSS is not provided in the input, so near-term exploitation probability cannot be quantified here - treat its absence as missing data, not as a low score. Net: this is a genuinely serious client-side RCE in an extremely widespread product and should be patched promptly, but it is driven by social-engineering delivery (phishing with a malicious document) rather than unauthenticated wormable network exploitation, so it is a 'patch on normal priority cycle' issue rather than an emergency drop-everything KEV-class threat.

An attacker emails or otherwise delivers a maliciously crafted Word document to a target and lures them into opening it (phishing/spear-phishing). On open, parsing the document triggers a heap-based buffer overflow (CWE-122) in Office Word, corrupting memory to execute arbitrary code in the context of the current user. No public exploit code is identified at time of analysis, and user interaction is required, so delivery depends on social engineering.