Product:
Microsoft Office Word
Summary
External control of file name or path in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. This vulnerability can lead to potential data exposure if exploited. Users should be aware of the risks associated with opening documents from untrusted sources.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2026-40421 |
Exploitation
An attacker can exploit this vulnerability by crafting a malicious document that contains a specially designed file name or path. When a user opens this document in Microsoft Office Word, the application may inadvertently disclose sensitive information over the network. This requires user interaction, as the user must open the malicious document for the exploit to succeed.
Affected Products
- Microsoft Office Word: Vulnerable to unauthorized information disclosure through external control of file names or paths.
Mitigation
To mitigate this vulnerability, users should avoid opening documents from untrusted sources and ensure that their software is updated to the latest version. Implementing security measures such as email filtering and user training can also help reduce the risk of exploitation.