Microsoft Word For Android
Monthly
Spoofing in Microsoft Office (Office LTSC for Mac 2021/2024 and Excel/Word for Android) lets an attacker with local access bypass access-control checks (CWE-284) to misrepresent content or its origin to a user. Microsoft has issued a patch; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 13th percentile), so this is a low-likelihood but high-technical-impact issue.
Spoofing in Microsoft Word for Android (versions 16.0.0.0 up to but excluding 16.0.19822.20190) stems from an improper access control weakness (CWE-284) that an already-authorized local attacker can abuse to misrepresent content or identity. The CVSS 3.1 vector (AV:L/PR:L) confirms a local, low-privileged authenticated attacker is required, and SSVC rates technical impact as total despite no listed availability impact. There is no public exploit identified at time of analysis, EPSS is a very low 0.04% (12th percentile), and it is not on the CISA KEV list.
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop applications that allows remote attackers to disclose sensitive information through crafted AI prompts. The vulnerability affects numerous Microsoft products across iOS, Android, and macOS platforms, requires user interaction, and has a patch available from Microsoft with no current evidence of active exploitation (not in KEV).
Spoofing in Microsoft Office (Office LTSC for Mac 2021/2024 and Excel/Word for Android) lets an attacker with local access bypass access-control checks (CWE-284) to misrepresent content or its origin to a user. Microsoft has issued a patch; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 13th percentile), so this is a low-likelihood but high-technical-impact issue.
Spoofing in Microsoft Word for Android (versions 16.0.0.0 up to but excluding 16.0.19822.20190) stems from an improper access control weakness (CWE-284) that an already-authorized local attacker can abuse to misrepresent content or identity. The CVSS 3.1 vector (AV:L/PR:L) confirms a local, low-privileged authenticated attacker is required, and SSVC rates technical impact as total despite no listed availability impact. There is no public exploit identified at time of analysis, EPSS is a very low 0.04% (12th percentile), and it is not on the CISA KEV list.
CVE-2026-26133 is an AI command injection vulnerability in Microsoft 365 Copilot and multiple Microsoft mobile/desktop applications that allows remote attackers to disclose sensitive information through crafted AI prompts. The vulnerability affects numerous Microsoft products across iOS, Android, and macOS platforms, requires user interaction, and has a patch available from Microsoft with no current evidence of active exploitation (not in KEV).