Microsoft
This is rated high severity (7.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Microsoft 365 Apps and Microsoft Office Long Term Servicing Channel are in your estate, and treat that as the priority.
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
Exploitable only with local access without any account, but only if a user takes an action, such as opening a file or link. High impact on confidentiality, integrity and availability.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Impact
Longer bar: more harm
2 links from the CVE record, grouped by site; the vendor's advisory comes first.
msrc.microsoft.com1 linkVendor advisory
cisa.gov1 link
Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorised attacker to elevate privileges locally.
Next step: Confirm whether Microsoft Office is in your estate.
Who's reporting
1 of 3 perspectives
Official authority: Official 1Vendor statement missing. no VendorResearcher coverage missing. no Researcher1 signal
Only official coverage so far. Treat as an early signal.
