CVE-2026-108433: Microsoft Office Word Security Feature Bypass Vulnerability
Microsoft Office Word Security Feature Bypass Vulnerability
Other sources
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.114.26101123
Event History
Frequently Asked Questions
What level of access and user interaction does exploitation require?
The vulnerability is locally exploitable and does not require privileges. Exploitation requires user interaction.
Which Office deployments are identified as affected?
The affected software list includes Microsoft 365 Apps for Enterprise; Office LTSC 2021 and 2024 in 32-bit and 64-bit editions; Office 365 for Mac; and Office LTSC for Mac 2021 and 2024.
What is the potential impact if the security feature bypass succeeds?
The supplied severity vector rates confidentiality, integrity, and availability impacts as high. The issue is classified as a security feature bypass caused by reliance on untrusted inputs in a security decision.