This vulnerability (CVE-2026-21514) involves Microsoft Office Word within Microsoft 365 Apps for Enterprise improperly relying on untrusted inputs when making a security decision. This flaw allows an unauthorized local attacker to bypass a security feature, potentially leading to full compromise of confidentiality, integrity, and availability of affected systems. The CVSS 3.1 vector indicates low attack complexity, no privileges required, but user interaction is needed. Microsoft has published an official fix and manages remediation for this cloud service.

Successful exploitation allows an attacker to bypass security features locally, resulting in high impact on confidentiality, integrity, and availability of the affected application and potentially the host system. No known active exploits have been reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise are updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514.