CVE-2026-70300
9.8CriticalPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-822
Impact
Remote attackers can execute arbitrary code over the network without authentication or user interaction. They only need network reachability to an affected Microsoft Word service or endpoint processing documents.
Root cause
An untrusted pointer dereference flaw in Microsoft Word allows attackers to trigger arbitrary memory corruption and code execution.
Affected systems
Microsoft Office Word; versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Check the MSRC vendor advisory for the fixed patch release and install it via Microsoft Update. If patching must wait, isolate hosts running Word from untrusted network traffic and block inbound document processing on network entry points.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.