CVE-2026-88210: Microsoft Office Word Security Feature Bypass Vulnerability
Microsoft Office Word Security Feature Bypass Vulnerability
Other sources
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases
Event History
Frequently Asked Questions
What does an attacker need to exploit this vulnerability?
The attacker must cause a user to interact with untrusted input in Word. The attack is local, and the available data does not indicate that prior authentication or privileges are required.
Which Office deployments should be reviewed?
Review Microsoft 365 Apps for Enterprise, Microsoft Office Word, Office LTSC 2024 32-bit and 64-bit editions, Office LTSC for Mac 2021 and 2024, and Office 365 for Mac. The provided information does not identify unaffected versions or configurations.
What is the potential impact if exploitation succeeds?
Successful exploitation bypasses a Word security feature. The supplied severity vector rates confidentiality, integrity, and availability impact as high.