CVE-2026-108427
8.8HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-20, CWE-122
Impact
Remote attackers can execute arbitrary code on the victim's system, but they need a user to open a malicious document. Exploitation gives attackers the same system privileges as the user running the application.
Root cause
Improper input validation leads to a heap-based buffer overflow during document parsing.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Apply the official security update for Microsoft Office Word from MSRC once available. Until patched, block untrusted Word documents at the email gateway and avoid opening Office files from unknown sources.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.