CVE-2026-108444
8.8HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-122
Impact
Attackers can achieve remote code execution in the context of the local user if a target opens a malicious file. They do not need prior authentication or privileges, but they do require user interaction to open the payload.
Root cause
A heap-based buffer overflow (CWE-122) triggers when parsing untrusted input in Microsoft Office.
Affected systems
Microsoft Office (versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Install the latest security updates provided in the Microsoft Security Update Guide. If patching immediately is not possible, block untrusted Microsoft Office files at perimeter mail gateways and ensure Protected View remains enabled.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.