Microsoft Office EUVD-2026-99736

Exploitation requires the victim to open or preview an attacker-supplied malicious Office file (UI:R), typically delivered by email or a link - this user-interaction requirement is the primary limiting factor and is why CISA SSVC rates the flaw as not Automatable. No authentication is needed on the attacker side (PR:N), and the attack works over the network against affected desktop Office installations: Microsoft Office LTSC 2021 (before 16.0.14334.20974), Office LTSC 2024 (before 16.0.17932.21056), Microsoft 365 Apps for Enterprise, and the Mac builds of Office LTSC 2021/2024 and Office 365 for Mac. The description does not name a specific non-default feature or configuration, so this appears exploitable against default Office configurations once a crafted document is opened; the key defensive limits are the required user action, Protected View / Mark-of-the-Web sandboxing, and the fact that code executes only with the opening user's privileges (scope unchanged, S:U).

This is a genuine high-priority vulnerability, though not an emergency at the time of analysis. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes an unauthenticated, low-complexity, network-delivered heap overflow (CWE-122) with total compromise of confidentiality, integrity, and availability - but it requires user interaction (UI:R), meaning the victim must open or preview a malicious document. CISA's SSVC framework corroborates this nuance: Technical Impact is 'total' (consistent with C:H/I:H/A:H), yet Exploitation is currently 'none' and Automatable is 'no' - the latter directly reflecting the UI:R requirement that prevents hands-off, wormable mass exploitation. No EPSS score was supplied in the input, and the vulnerability is NOT in CISA KEV and has no public POC, so active-exploitation and widespread-exploit signals are both absent. The signals are therefore consistent rather than conflicting: high potential impact tempered by the need for user interaction and the absence of any observed exploitation. Given the enormous install base of Microsoft Office and Microsoft's history of Office document parsers being targeted via phishing, this warrants prompt patching, but it is not yet an in-the-wild zero-day.

An attacker emails a victim a specially crafted Office document (or hosts it on a web/file share) that, when opened, triggers a heap-based buffer overflow in Office's file parser. The malformed data corrupts heap memory to achieve arbitrary code execution in the context of the user who opened the file. No public exploit code has been identified at the time of analysis, and because user interaction is required (UI:R), successful attacks depend on social engineering to get the target to open the document.