CVE-2026-108451
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A numeric truncation error in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The flaw stems from improper handling of numeric values.
Risk Assessment
An attacker can remotely execute arbitrary code in the context of the Word process, potentially leading to full system compromise. The risk is high as no authentication is required.
Recommendation
Update Microsoft Office Word to the latest patched version. Avoid opening suspicious documents and enforce macro restriction policies.
Other vulnerabilities in Microsoft Office Word
See all- CVE-2026-41101High
Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.
- CVE-2026-40364High
In Microsoft Office Word, a vulnerability related to access of resource using incompatible type ('type confusion') allows an unauthorized attacker to execute code locally.
- CVE-2026-20948High
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-20944High
An out-of-bounds read vulnerability in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-70300Critical
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-108450High
A heap-based buffer overflow in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The vulnerability occurs when processing specially crafted data.
- CVE-2026-108449High
A heap-based buffer overflow in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The vulnerability occurs when processing specially crafted data.
- CVE-2026-108447High
A heap-based buffer overflow in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The vulnerability occurs when processing specially crafted data.
- CVE-2026-108445High
A stack-based buffer overflow in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The vulnerability occurs when processing specially crafted data.
- CVE-2026-108443High
An off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. The flaw stems from an incorrect buffer size calculation by one byte.
Original NVD description (English source)
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS