Description

Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:49.267Z",
  "pubdate": "2026-08-11T17:18:49.267Z",
  "executiveSummary": "This vulnerability involves a numeric truncation error within Microsoft Office Word, categorized as a memory corruption flaw. The vulnerability allows an unauthorized local attacker to achieve arbitrary code execution on target systems hosting the vulnerable software.\nThe primary impact of successful exploitation is the execution of arbitrary code with the privileges of the currently logged-on user. If the user possesses administrative privileges, the compromise can extend to a full system takeover, posing significant risk to enterprise environments where Microsoft Office is widely deployed.\nExploitation requires the attacker to execute local actions, typically by convincing a user to open a specially crafted malicious document using the vulnerable application. The flaw stems from improper handling of integer boundaries during the parsing of specific file structures, leading to memory corruption and subsequent control flow hijacking without requiring prior authentication.",
  "technicalDetails": "The root cause of the vulnerability resides in a numeric truncation error within the document parsing engine of Microsoft Office Word. When processing specific embedded numerical attributes or size descriptors within a crafted document file, the application fails to adequately validate input boundaries.\nThis failure leads to an integer or numeric truncation condition where a value exceeding the expected bit-width is cast or copied into a smaller destination buffer. Consequently, the memory allocation routine calculates a buffer size that is smaller than the actual data being written, precipitating a classic heap-based or stack-based buffer overflow.\nThe exploitation method requires an attacker to deliver a malformed document file containing manipulated size fields that trigger the numeric truncation flaw. The attack flow commences when the victim opens the malicious file via Microsoft Office Word. As the parsing engine interprets the corrupted structure, the truncation error results in miscalculated memory allocation sizes during object deserialization.\nSubsequent write operations overrun the boundaries of the allocated heap or stack buffer, corrupting adjacent memory regions, function pointers, or critical execution structures. By carefully crafting the payload within the document, the attacker can overwrite return addresses or virtual method table pointers with malicious shellcode addresses.\nWhen the execution flow returns to the manipulated pointer, control is transferred to the attacker's shellcode. The payload executes within the context of the user running Microsoft Office Word, inheriting standard user privileges. Due to the local nature of the attack vector, network exposure is indirect, relying on social engineering or local file placement to deliver the payload. No authentication is required to trigger the parsing logic once the file is opened."
}