CVE-2026-88150

Summary

Microsoft Word allows execution of arbitrary code when processing documents with uninitialized resources, potentially enabling remote code execution without user interaction. This vulnerability affects Microsoft 365 apps and Office 2021/2024 products.

Exploitability

Exploitation requires a user to open a malicious Word document over a network, making it moderately difficult but possible with social engineering or phishing campaigns.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on affected systems with the privileges of the logged-in user, potentially leading to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Deploy Microsoft Security Update KB5041234 for Office 2021 and Office 2024, or upgrade to Microsoft 365 Apps version 2408 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.