AI analysis
CVE-2026-70300 is an untrusted pointer dereference (CWE-822) in Microsoft Office Word. Microsoft rates it critical (CVSS 3.1 9.8) with network attack vector, low complexity, no privileges, and no user interaction, allowing an unauthorized attacker to execute code remotely with high impact to confidentiality, integrity, and availability. Affected products named in the advisory data are Microsoft 365 Apps, Office 2021, and Office 2024; specific patched build numbers are not included in the source data. It is not listed in CISA KEV and no public proof-of-concept is known, so exploitation status is none known.
What to do: Install the latest Microsoft security updates for Microsoft 365 Apps, Office 2021, and Office 2024 as soon as they are available, and confirm Word is no longer on an unpatched build. Until then, avoid opening Word documents from untrusted sources and restrict preview of untrusted files in mail and web clients where possible.
Affected
| Microsoft 365 Apps | Microsoft 365 Apps (affected builds as identified by Microsoft for this CVE; no specific build numbers in the source data) |
| Microsoft Office 2021 | Office 2021 (affected builds as identified by Microsoft for this CVE; no specific build numbers in the source data) |
| Microsoft Office 2024 | Office 2024 (affected builds as identified by Microsoft for this CVE; no specific build numbers in the source data) |
Estimated exposure
massOn the order of 100 million+ Word users/installations across Microsoft 365 Apps, Office 2021, and Office 2024 — Microsoft 365 and perpetual Office (2021/2024) are standard productivity suites with well over 100 million commercial and consumer seats worldwide, so vulnerable Word installations are plausibly in the hundreds of millions even without a…