EUVD-2026-99738
GHSA-hfxm-r6g6-pvhw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Word document
-
DeliveryDeliver via phishing email
-
ExploitVictim opens document
-
ExecutionTrigger heap buffer overflow
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-crafted Microsoft Office Word document (UI:R in the CVSS vector) - this is the concrete, decisive precondition and the reason CISA rates the flaw non-automatable. No attacker authentication or privileges are required (PR:N), and delivery is over a network (AV:N), typically via phishing email, malicious download, or shared file. The user-interaction requirement is the primary limiting factor, meaning the flaw is not wormable and cannot be triggered against a passive target; organizations relying on attachment sandboxing, Protected View, or macro/file-type restrictions further reduce realistic exploitability. |
| Impact | Signals are moderately conflicting and point to a genuine-but-not-emergency priority. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R) is High, driven by network vector, low complexity, no attacker privileges, and total C/I/A impact - consistent with the SSVC 'Technical Impact: total' rating. However, the mitigating signals are strong and consistent: CISA SSVC reports 'Exploitation: none' and 'Automatable: no' (the latter because successful exploitation requires a victim to open a crafted document, per UI:R), and there is no CISA KEV listing and no identified public exploit. No EPSS score was provided in the input, so exploitation probability cannot be quantified here - this is a notable data gap. The net picture is a high-impact, client-side code-execution flaw in an extremely widely deployed product, but with no evidence of in-the-wild use and a required user-interaction barrier that prevents wormable/automatable spread. Treat as a high-priority patch for an ubiquitous product (large attack surface via phishing), not as an actively-exploited zero-day emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious Word document that triggers the heap-based buffer overflow (CWE-122) and emails it to a target or hosts it for download. When the victim opens the document, memory corruption leads to arbitrary code execution in the context of the user. No public exploit code has been identified at time of analysis, and exploitation requires the user to open the file (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Heap-based buffer overflow in Microsoft Word enables unauthenticated remote attackers to execute arbitrary code if a victim opens a crafted document. The flaw affects Microsoft Office LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Office for Mac; a vendor-released patch is available. No public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as none and automatable as no, reflecting the required user interaction.
RemediationAI
Apply the vendor-released patch from Microsoft by updating to the fixed versions specified in the security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88202. Specifically, update Microsoft Office LTSC 2021 to version 16.0.14334.20974 or later, Microsoft Office LTSC 2024 to version 16.0.17932.21056 or later, and Microsoft 365 Apps for Enterprise via the Office Security Releases page (https://aka.ms/OfficeSecurityReleases). For Mac versions, check for updates via Microsoft AutoUpdate once fixed versions are published. As compensating controls, enforce Protected View for documents from untrusted sources and disable macros by default; these reduce the risk of exploitation but may impact productivity and break legitimate macro-based workflows. Additionally, use attachment sandboxing and block risky file types at the email gateway, though these are not substitutes for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a heap-based buffer overflow (CWE-122) in Microsoft Word's parsing of document files. An attacker can craft a malicious Word document that, when opened, triggers a memory corruption condition, potentially allowing arbitrary code execution in the context of the user. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates the attack is network-delivered, low complexity, requires no privileges, but requires user interaction (UI:R) to open the file. SSVC assessment notes exploitation is none, automatable is no, and technical impact is total. The affected products include Microsoft Office LTSC 2021 (16.0.1 <16.0.14334.20974), Office LTSC 2024 (16.0.0 <16.0.17932.21056), Microsoft 365 Apps for Enterprise (16.0.1 <latest via Office Security Releases), and Office LTSC for Mac 2021/2024 and Office 365 for Mac (awaiting publication of fixed versions). The root cause is improper bounds checking when handling objects in memory, leading to heap overflow.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered malicious document needs no attacker privileges (PR:N) but requires the victim to open it (UI:R); memory-corruption RCE yields total C/I/A within the user's context (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity memory corruption flaw in Microsoft Word could let an attacker run malicious code on any employee workstation where a crafted document is opened, putting widely deployed productivity endpoints across the organization at risk. Because Word is used daily by nearly every knowledge worker and the attack requires only that a user open a file, a single lapse in judgment could turn into a full endpoint compromise with follow-on data, credential, and lateral-movement exposure. A vendor fix is already available, so leadership should prioritize rapid, organization-wide deployment rather than accept prolonged exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Exploit-DB