Product:
Microsoft Office
Summary
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. This vulnerability can lead to significant impacts on confidentiality, integrity, and availability. Attackers can exploit this flaw without requiring any privileges or user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2026-40363 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected system. By crafting a malicious document and convincing the user to open it, the attacker can trigger the buffer overflow, leading to arbitrary code execution. This can be done through various means, such as phishing or social engineering tactics.
Affected Products
- Microsoft Office: A suite of productivity applications that may be vulnerable to local code execution due to a heap-based buffer overflow.
Mitigation
To mitigate this vulnerability, users should ensure that they are running the latest version of Microsoft Office with all security updates applied. Additionally, restricting local access to systems and educating users about the risks of opening untrusted documents can help reduce the likelihood of exploitation.