CVE-2026-108439
8.8HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-122
Impact
Remote attackers can execute arbitrary code with the privileges of the local user if a target opens a malicious Word file. The attacker needs no prior network access or credentials, only user interaction.
Root cause
A heap-based buffer overflow flaw exists in Microsoft Word's document parsing logic.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Install the security update from Microsoft for Microsoft Word or Office. If patching must wait, block untrusted Word attachments at your email gateway or configure Microsoft Office to open external documents strictly in Protected View.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.