This vulnerability (CVE-2026-41101) in Microsoft Word for Android is classified under CWE-284 (Improper Access Control). It permits an attacker with limited privileges (authorized user) to conduct spoofing attacks locally, potentially leading to high confidentiality and integrity impacts. The CVSS 3.1 base score is 7.1, reflecting a high severity with local attack vector, low attack complexity, and no user interaction required. Microsoft has published an official fix for this vulnerability.

An authorized attacker can exploit this vulnerability to spoof content or interface elements within Microsoft Word for Android, potentially misleading users or causing unauthorized information disclosure or modification. The confidentiality and integrity impacts are rated high, while availability is not affected. No known active exploitation has been reported.

An official fix is available from Microsoft. Users and administrators should apply the provided security update for Microsoft Word for Android version 16.0.0.0 as soon as possible. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41101 for detailed patching instructions.