CVE-2026-70300 – Microsoft Office Word Remote Code Execution Vulnerability

Microsoft has released a security update on October 13, 2026, addressing CVE-2026-70300, a Critical remote code execution vulnerability affecting Microsoft Office Word. The vulnerability is caused by an untrusted pointer dereference that could allow an unauthenticated attacker to execute malicious code when Microsoft Word processes a specially crafted WordPerfect document containing a linked graphics file. The vulnerability can be triggered through the Reading Pane or Preview Pane without requiring the user to manually open the document. With low attack complexity, no authentication requirements, and no user interaction required, successful exploitation could compromise sensitive business information, enable unauthorized code execution, and disrupt organizational operations.

CVSS Score: 9.8

SEVERITY: Not specified in the CVSS:3.1 Metrics.

Threat

The primary threat is remote code execution through the automatic processing or previewing of a malicious document in Microsoft Word.

An attacker could create a specially crafted WordPerfect document containing a linked graphics file and deliver it to a target user. When Microsoft Word processes the document in the Reading Pane or Preview Pane, the vulnerability could be triggered without the user manually opening the file.

This makes the vulnerability especially concerning because traditional security awareness practices, such as avoiding suspicious attachments, may not fully protect users when document preview functionality can trigger exploitation.

No authentication or user interaction is required, creating a potentially dangerous attack scenario for organizations that regularly receive and process external documents.

Exploits

• Publicly Disclosed: No
• Actively Exploited: No
• Public Proof-of-Concept (PoC): Not confirmed; exploit code maturity is listed as Unproven.
• Exploitability Assessment: Exploitation Less Likely

Microsoft indicates that exploitation is less likely, and the vulnerability information does not identify any known active exploitation.

However, the combination of low attack complexity, no authentication requirement, and exploitation through document preview functionality makes this vulnerability a significant security concern.

Technical Summary

CVE-2026-70300 is an untrusted pointer dereference vulnerability, classified as CWE-822, affecting Microsoft Office Word.

An untrusted pointer dereference occurs when software uses a memory pointer that has not been properly validated. If the pointer contains an attacker-controlled or unexpected address, the application may access unintended memory locations, potentially leading to memory corruption, unexpected behavior, or unauthorized code execution.

In this case, an attacker could create a specially crafted WordPerfect document containing a linked graphics file designed to trigger the vulnerability.

When Microsoft Word processes the malicious document through the Reading Pane or Preview Pane, the vulnerable component could dereference an untrusted pointer, potentially allowing the attacker to execute code on the affected system.

The CVSS v3.1 metrics identify several important characteristics:

• Attack Vector: Network, allowing malicious documents to be delivered remotely.
• Attack Complexity: Low, indicating exploitation does not require unusually complex conditions.
• Privileges Required: None, meaning the attacker does not need authenticated access.
• User Interaction: None, because the vulnerability can be triggered through document preview functionality.
• Scope: Unchanged, indicating the impact remains within the affected security authority.
• Confidentiality: High, indicating the potential exposure of sensitive information.
• Integrity: High, indicating the possibility of unauthorized modification of information or system resources.
• Availability: High, indicating potentially serious disruption to affected systems.

Successful exploitation could allow an attacker to execute malicious code on the user’s system. The exact execution privileges are not specified in the available vulnerability details.

Exploitability

The affected Microsoft products include:

• Microsoft 365 Apps for Enterprise: 32-bit and 64-bit editions.
• Microsoft Office LTSC 2024: 32-bit and 64-bit editions.
• Microsoft Office LTSC 2021: 32-bit and 64-bit editions.

An unauthenticated attacker could send a specially crafted WordPerfect document with a linked graphics file to a target user. Processing the document through the Reading Pane or Preview Pane could trigger remote code execution without requiring the user to open the document.

Business Impact

CVE-2026-70300 represents a serious security risk for organizations that depend on Microsoft Word for everyday business communications and document processing.

Word documents are routinely exchanged through email, shared drives, collaboration platforms, and external business relationships. Attackers could exploit these familiar workflows by delivering malicious documents disguised as invoices, contracts, reports, or other legitimate business materials.

The ability to trigger exploitation through document preview functionality creates additional risk because employees may be exposed to malicious content without deliberately opening a suspicious file.

Potential business consequences include:

• Unauthorized System Compromise: Attackers could execute malicious code on affected Windows devices.
• Sensitive Data Exposure: Confidential business documents, customer records, and internal information could potentially be accessed or stolen.
• Malware Deployment: Compromised systems could be used to install ransomware, spyware, or other malicious software.
• Operational Disruption: Attacks could interrupt employee productivity and business-critical applications.
• Lateral Movement: A compromised workstation could potentially provide an entry point for attacks against additional systems.
• Financial and Reputational Damage: Security incidents could result in recovery expenses, downtime, regulatory consequences, and loss of customer confidence.

“When simply previewing a document can lead to malicious code execution, everyday office communication becomes a potential gateway for attackers.”

Workaround

Until the official Microsoft security update can be deployed, organizations should consider the following risk-reduction measures:

• Disable the Preview Pane and Reading Pane for untrusted documents where operationally feasible.
• Avoid previewing or processing WordPerfect documents from unknown or untrusted sources.
• Use email security controls to scan and quarantine suspicious document attachments.
• Restrict access to external documents and apply least-privilege controls.
• Deploy the appropriate Microsoft Office security updates promptly.

These measures may reduce exposure but are not confirmed Microsoft workarounds for the underlying vulnerability.

Urgency

CVE-2026-70300 carries a Critical maximum severity rating and a CVSS v3.1 base score of 9.8, making it a high-priority security concern for organizations using affected Microsoft Office products.

The vulnerability is particularly dangerous because an attacker does not need valid credentials or user interaction to attempt exploitation. The ability to trigger code execution through the Reading Pane or Preview Pane increases the potential exposure of users who routinely handle external documents.

Although Microsoft considers exploitation less likely and reports no known active exploitation, the potential consequences of a successful attack are serious.

Organizations should prioritize identifying affected Microsoft 365 and Office installations, reviewing document preview settings, and deploying the October 2026 Microsoft Office security updates as quickly as operationally feasible.

“When attackers can exploit a document before someone even opens it, patching Microsoft Word becomes an essential defense against silent system compromise.”