Microsoft Word EUVD-2026-99804

Exploitation requires a victim to open an attacker-crafted Word document in Microsoft Office Word; the CVSS UI:R metric confirms mandatory user interaction, which is the primary limiting factor. No special or non-default configuration is indicated - any affected Office/Word build processing the malicious file is at risk. Affected products per EUVD include Microsoft 365 Apps for Enterprise, Office LTSC 2024 (fixed in 16.0.17932.21056), Office LTSC 2021 (fixed in 16.0.14334.20974), and Office LTSC/365 for Mac 2021/2024. The attacker needs no authentication or prior privileges (PR:N), but cannot succeed without the user action, and code executes only in that user's security context (S:U), not at elevated/system level.

This is a credible but interaction-gated priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H, base 7.8) describes a local, no-privilege, low-complexity code-execution flaw whose single real barrier is required user interaction - consistent with the classic 'open a malicious Word document' pattern rather than remote network exploitation. Note AV:L here means the victim must process an attacker-supplied file locally, not that the attacker needs prior local access; this is the standard Microsoft rating for document-parsing bugs and is not a contradiction with the 'unauthorized attacker' description. No EPSS score, CISA KEV entry, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the priority therefore rests on impact (full C/I/A compromise in the user's context) and the ubiquity of Office, not on demonstrated weaponization. The missing EPSS/KEV/POC signals mean exploitation likelihood cannot be quantified from this data; absence is not confirmation of safety, but it does argue against treating this as an emergency ahead of document-parser CVEs that carry those signals. A patch is available from the vendor, so remediation is straightforward and should be prioritized on standard Patch Tuesday cadence given the install base.

An attacker emails or shares a specially crafted Word document (or hosts it for download) and social-engineers a victim into opening it. On open, Word's parsing of the malformed content triggers a heap-based buffer overflow, letting the attacker run arbitrary code in the context of the current user. No public exploit code was identified in the supplied data, and successful exploitation depends on the user opening the file.