Microsoft Word EUVD-2026-99718

Exploitation requires the victim to open an attacker-crafted Word document (UI:R in the CVSS vector) - the overflow is triggered during document parsing by Office Word, so there is no fully unattended remote trigger. No authentication or prior privileges on the target are needed (PR:N), and attack complexity is low (AC:L) with no special target configuration required beyond having a vulnerable Office/Word build installed. Affected builds per EUVD include Microsoft Office LTSC 2024 (<16.0.17932.21056), Office LTSC 2021 (<16.0.14334.20974), Microsoft 365 Apps for Enterprise, and the Office LTSC/365 for Mac channels. The required user interaction is the primary limiting factor, making successful attacks dependent on social engineering rather than automated mass exploitation (SSVC Automatable: no).

This is a genuinely high-priority vulnerability by composition of signals, but not an active-exploitation emergency at time of analysis. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-deliverable, low-complexity, unauthenticated code-execution flaw with full confidentiality, integrity, and availability impact, tempered only by the required user interaction (UI:R). CISA's SSVC framework, however, downgrades urgency: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (consistent with UI:R - each victim must open a crafted file, so this cannot be sprayed/wormed), while Technical Impact is 'total' (consistent with C:H/I:H/A:H). There is no CISA KEV listing and no POC referenced in the provided data, so this is 'no public exploit identified at time of analysis.' EPSS is not provided in the input, so exploitation probability cannot be quantified here - a real data gap. Net: a high-impact, easy-to-trigger-but-user-gated RCE in extremely widespread software with a vendor patch available. The headline 8.8 slightly overstates immediate risk because the 'no exploitation / not automatable' SSVC signals and the UI:R dependency indicate opportunistic, phishing-style abuse rather than mass automated compromise - patch promptly, but it is not yet a confirmed in-the-wild threat.

An attacker crafts a malicious Word document that triggers a heap-based buffer overflow (CWE-122) when parsed and emails it to a target or hosts it for download. When the victim opens the document, the overflow corrupts heap memory and allows the attacker to execute arbitrary code in the victim's user context. No public proof-of-concept exploit is identified at time of analysis, and the AV:N/AC:L/UI:R vector means delivery is easy but success depends on the user opening the file.