Microsoft Office EUVD-2026-99735

Exploitation requires a user to open an attacker-crafted Office document (UI:R) that triggers the heap-based buffer overflow in Office's file parsing; no authentication or pre-existing privileges are needed (PR:N). Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and Office for Mac (LTSC 2021/2024, Office 365 for Mac), so both Windows and macOS Office installations are in scope. The principal limiting factor is the mandatory user interaction - the victim must be convinced to open the malicious file - which means delivery depends on phishing or social engineering rather than unassisted remote exploitation; Protected View or blocking documents from untrusted sources further reduces real-world exposure.

This is a credible prioritization candidate but not a top-tier emergency based on current signals. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-deliverable, low-complexity, unauthenticated code execution with full confidentiality, integrity, and availability impact - the classic profile of a malicious-document attack in Microsoft Office. The single mitigating metric is UI:R (user interaction required), meaning a victim must open a crafted file; this is the primary brake on mass exploitability. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or available exploit code at time of analysis. The signals are therefore internally consistent (no conflict between CVSS and the description) but incomplete: high intrinsic severity and ubiquitous attack surface argue for prompt patching, while the absence of KEV/EPSS/POC means this is not yet a confirmed widespread-exploitation event. Office memory-corruption bugs with these characteristics are historically attractive to both commodity malware and targeted actors once a patch enables diffing, so the window between patch and exploitation can be short even without current POC evidence.

An attacker emails or hosts a specially crafted Office document that, when opened by a user, triggers a heap-based buffer overflow in Office's file parser and runs attacker-controlled code in the context of the victim. Because exploitation requires the user to open the file (UI:R), delivery typically relies on phishing or social engineering rather than fully automated remote compromise. No public proof-of-concept or active exploitation is identified in the provided data.