CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability

Microsoft Office Word contains a vulnerability that lets an authorized local attacker elevate privileges by supplying input the application should not trust for security decisions. The issue stems from reliance on untrusted data when making access-control or privilege checks, which can allow the attacker to obtain higher rights on the affected system without remote execution.

How it works

The weakness is classified as CWE-807, reliance on untrusted inputs in a security decision. In this class of flaw the software accepts data from a source that lacks integrity guarantees and uses that data to decide whether to grant elevated rights or bypass restrictions. An attacker with local access supplies crafted input that the application treats as authoritative, resulting in an unintended privilege increase on the same host. No remote code execution or unauthenticated access is described in the available summary.

Am I affected? How to find it in your systems

The vulnerability affects Microsoft Office Word. Inventory all endpoints and servers that run Microsoft Office by querying installed product versions through standard management tools or configuration management databases. Focus on Word installations that process untrusted documents or templates. Because exact version numbers and configuration triggers are not provided here, compare your inventory directly against the vendor advisory to determine exposure. Review local security event logs and application telemetry for unexpected privilege changes or anomalous document-handling behavior that could indicate attempted exploitation.

How to remediate

Apply the vendor-supplied update referenced in the official Microsoft advisory as the primary remediation. After patching, review any additional hardening steps Microsoft publishes for this class of input-validation issue. Confirm that cloud-hosted Office services follow the applicable BOD 22-01 guidance if those services are in scope.

If you can't patch immediately

Until the update can be deployed, apply mitigations exactly as stated by the vendor. Segment endpoints so that users who must retain local access cannot easily reach systems holding higher-privilege resources. Monitor authentication and process-creation events for signs of unexpected privilege transitions. If vendor mitigations are unavailable, discontinue use of the affected product until remediation is possible.

If your data may have been exposed

Actively exploited instances of this vulnerability class have led to unauthorized access and subsequent data exposure in other incidents. Organizations can run a free exposure scan of their domains and email addresses against known breach data to determine whether credentials or documents have already appeared in public repositories.