{"id":"CVE-2026-70300","published":"2026-10-13T19:19:50.007","lastModified":"2026-10-14T20:14:43.740","description":"Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-822"],"vendors":["microsoft"],"products":["365 apps","office 2021","office 2024"],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70300","tags":["Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical untrusted pointer dereference vulnerability in Microsoft Word allows remote attackers to execute arbitrary code on affected systems. This flaw occurs when Word processes untrusted input from documents, potentially leading to complete system compromise.","exploitability":"Exploitation is relatively straightforward requiring only a malicious Word document delivered over the network, with no user interaction needed for initial execution.","blast_radius":"The vulnerability affects all Windows users running Microsoft Office Word, making it highly impactful across enterprise environments where Word documents are commonly shared and opened.","remediation":"Disable the ability to open .docx files from untrusted sources or implement strict file validation policies. No specific fixed version is published in the description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","office","remote"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:48:51.457Z"}}