Microsoft Word Critical RCE Vulnerability CVE-2026-70300 Allows Remote Code Execution
A critical flaw in Microsoft Office Word enables remote code execution via untrusted pointer dereference, rated 9.8 on CVSS scale.
Key points
- Microsoft Office Word contains a critical remote code execution vulnerability identified as CVE-2026-70300.
- The flaw involves an untrusted pointer dereference that allows unauthorized attackers to execute code over a network.
- The National Vulnerability Database rates the severity as 9.8, categorized as Critical.
Microsoft has disclosed a critical remote code execution vulnerability in Microsoft Office Word, designated CVE-2026-70300. The flaw allows unauthorized attackers to execute arbitrary code on affected systems over a network, posing a significant risk to users of the productivity suite.
The vulnerability stems from an untrusted pointer dereference within the application. According to the National Vulnerability Database, this weakness is classified under CWE-822. The CVSS score for this issue is 9.8, which places it in the Critical severity range.
Technical Context and Severity
The Microsoft Security Update Guide describes the issue as allowing an unauthorized attacker to execute code over a network. This means that exploitation does not require physical access to the target machine. Instead, an attacker can leverage the vulnerability through network-based interactions.
The specific technical mechanism is an untrusted pointer dereference. The National Vulnerability Database links this CVE to CWE-822. The source material does not provide further definition of CWE-822 beyond its association with this vulnerability.
Affected Software and Scope
Microsoft Office Word is the primary product affected by CVE-2026-70300. The advisory from Microsoft explicitly names Microsoft Office Word in the title and summary of the vulnerability record. The source material does not list specific version numbers or operating system constraints.
The scope of the vulnerability is limited to the information provided in the advisory. The ability to execute code remotely is stated in the description. The lack of required privileges for the attacker is noted in the description as allowing an "unauthorized attacker" to execute code.
What should you do?
Security professionals should monitor for official patches from Microsoft regarding CVE-2026-70300. Until a confirmed fix is available, organizations should restrict the ability to open untrusted documents from external sources. Email security gateways should be configured to block or sandbox attachments that trigger macro execution or contain embedded objects.
What to do and how to stay safe: Microsoft
- Monitor Microsoft Security Update Guide for the release of a patch addressing CVE-2026-70300.
- Restrict users from opening unsolicited Microsoft Word documents from unknown or untrusted senders.
- Ensure email security solutions are configured to scan and block malicious Office attachments.
- Review network traffic for unusual outbound connections that may indicate successful exploitation.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-70300?
CVE-2026-70300 is a critical remote code execution vulnerability in Microsoft Office Word caused by an untrusted pointer dereference.
How severe is this vulnerability?
The National Vulnerability Database rates CVE-2026-70300 as Critical with a CVSS score of 9.8.
Is there a fix available yet?
No fix has been confirmed yet in the provided source material; users should wait for an official update from Microsoft.
