This vulnerability (CVE-2026-66810) involves a heap-based buffer overflow in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. The flaw could be exploited by an unauthorized attacker to disclose information on the local system. The CVSS 3.1 vector indicates local attack vector with low attack complexity, no privileges required, and user interaction needed. The impact is high confidentiality loss without integrity or availability impact. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

The vulnerability allows unauthorized local attackers to disclose sensitive information due to a heap-based buffer overflow in Microsoft Word. There is no impact on integrity or availability. The confidentiality impact is high, meaning sensitive data could be exposed locally.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66810 to ensure their environment is updated and protected.