CVE-2026-20944
HighSummary
An out-of-bounds read vulnerability in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Risk Assessment
An attacker could exploit this vulnerability to run malicious code on the victim's machine, potentially compromising data confidentiality and integrity.
Recommendation
Install the latest security updates provided by Microsoft for Word.
Other vulnerabilities in Microsoft Office Word
See all- CVE-2026-20948High
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CVE-2026-70300Critical
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
- CVE-2026-40364High
In Microsoft Office Word, a vulnerability related to access of resource using incompatible type ('type confusion') allows an unauthorized attacker to execute code locally.
- CVE-2026-108451High
A numeric truncation error in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The flaw stems from improper handling of numeric values.
- CVE-2026-108450High
A heap-based buffer overflow in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The vulnerability occurs when processing specially crafted data.
- CVE-2026-108449High
A heap-based buffer overflow in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The vulnerability occurs when processing specially crafted data.
- CVE-2026-108447High
A heap-based buffer overflow in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The vulnerability occurs when processing specially crafted data.
- CVE-2026-108445High
A stack-based buffer overflow in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The vulnerability occurs when processing specially crafted data.
- CVE-2026-108443High
An off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. The flaw stems from an incorrect buffer size calculation by one byte.
- CVE-2026-108442High
A use-after-free vulnerability in Microsoft Office Word allows an unauthorized attacker to execute code over a network. The flaw involves accessing memory after it has been freed.
Original NVD description (English source)
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS