CVE-2026-108450
8.8HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-122, CWE-197
Impact
Attackers can achieve remote code execution in the context of the current user. To trigger it, an attacker must trick a user into opening a specially crafted Word document.
Root cause
A numeric truncation (CWE-197) triggers a heap-based buffer overflow (CWE-122) when parsing document data.
Affected systems
Microsoft Office Word; exact versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Install the official Microsoft security update for your installed Office build once released. Until patched, block untrusted Word attachments at your email perimeter and ensure Office Protected View remains enabled.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.