CVE-2026-108433: CWE-807: Reliance on Untrusted Inputs in a Security Decision in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-108433) in Microsoft Office Word within Microsoft 365 Apps for Enterprise is classified under CWE-807 (Reliance on Untrusted Inputs in a Security Decision). It allows a local unauthorized attacker to bypass a security feature by exploiting the application's improper validation of inputs. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service.

An unauthorized local attacker can bypass security features in Microsoft Office Word, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. This could allow unauthorized actions or access within the application context.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the provided updates as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108433. Since this is a cloud-hosted service, Microsoft manages remediation server-side, but local clients should be updated to ensure protection.