Microsoft Office < 16.106.26020821
Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.
A local attacker, without authentication, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2026-03-03 under CISA BOD 22-01.
This is a Software Vulnerability (CWE-807) (CWE-807) vulnerability in Microsoft Office. Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. Exploitation requires local access, low attack complexity, no authentication required, and user interaction required.
Probably yes if any of these apply:
CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2026-02-10 based on evidence of active exploitation in the wild. Federal agencies required to remediate by 2026-03-03.
Manual remediation steps
Apply the Microsoft Security Update
This vulnerability is fixed by Microsoft's official security update.
Affected Products
Installation Methods
Windows Update (recommended)
Microsoft Download Links
Verification
Confirm the update is installed:
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
References
Discovery Credit
Anonymous, Microsoft Threat Intelligence Center (MSTIC), Microsoft Security Response Center (MSRC), and Office Product Group Security Team, Google Threat Intelligence Group
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
References