CVE-2026-108433
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. The flaw involves making security decisions based on data that cannot be trusted.
Risk Assessment
An attacker with local access can bypass a security feature, potentially weakening workstation protection and facilitating further attacks.
Recommendation
Apply the Microsoft security update for Office Word as soon as possible and restrict local access to trusted users.
Other vulnerabilities in Microsoft Office Word
See all- CVE-2026-41101High
Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.
- CVE-2026-40364High
In Microsoft Office Word, a vulnerability related to access of resource using incompatible type ('type confusion') allows an unauthorized attacker to execute code locally.
- CVE-2026-20948High
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-20944High
An out-of-bounds read vulnerability in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-70300Critical
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-108451High
A numeric truncation error in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The flaw stems from improper handling of numeric values.
- CVE-2026-108450High
A heap-based buffer overflow in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The vulnerability occurs when processing specially crafted data.
- CVE-2026-108449High
A heap-based buffer overflow in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The vulnerability occurs when processing specially crafted data.
- CVE-2026-108447High
A heap-based buffer overflow in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The vulnerability occurs when processing specially crafted data.
- CVE-2026-108445High
A stack-based buffer overflow in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The vulnerability occurs when processing specially crafted data.
Original NVD description (English source)
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS