CVE-2026-88150
8.8HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-908
Impact
Remote attackers can execute arbitrary code on the target machine. To trigger it, an attacker must get a user to open a malicious Word document.
Root cause
Microsoft Office Word attempts to use uninitialized memory or resources during document processing.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Apply the security patch from the vendor advisory once identified; until then, block or quarantine untrusted Word documents at the email and web gateways.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute code over a network.