CVE-2026-72972
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Risk Assessment
An unauthorized attacker could remotely execute code on the victim's machine by opening a specially crafted Word document, potentially leading to system compromise.
Recommendation
Install security updates for Microsoft Office Word and exercise caution when opening documents from untrusted sources.
Other vulnerabilities in Microsoft Office Word
See all- CVE-2026-41101High
Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.
- CVE-2026-40364High
In Microsoft Office Word, a vulnerability related to access of resource using incompatible type ('type confusion') allows an unauthorized attacker to execute code locally.
- CVE-2026-20948High
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-20944High
An out-of-bounds read vulnerability in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-83951Medium
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
- CVE-2026-83949Medium
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
- CVE-2026-81952High
Heap-based buffer overflow in Microsoft Office Word. Allows an unauthorized attacker to execute code over a network.
- CVE-2026-80090Medium
Out-of-bounds read in Microsoft Office Word. An unauthorized attacker can disclose information over a network.
- CVE-2026-80088Medium
Out-of-bounds read in Microsoft Office Word. An unauthorized attacker can disclose information over a network.
- CVE-2026-80085High
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Original NVD description (English source)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS