CVE-2026-20944CWE-125

Microsoft Word Remote Code Execution Vulnerability

High · published January 13, 2026

CVSS v3.1
8.4
EPSS
1%
Percentile
42.7
In the wild
Unconfirmed
What it is

⚡ An out-of-bounds read in Microsoft Office Word could let an attacker execute code locally—like sneaking a peek at someone's private notes and then rewriting them! 🔥 Think of this as a waiter who accidentally delivers a secret recipe to the wrong table. If the waiter isn’t cautious, that recipe could be misused, leading to disastrous kitchen results! This vulnerability could allow an unauthorized attacker to run malicious code on your system, potentially paving the way for data theft or system compromise. Imagine someone gaining access to your documents, sensitive information, or even taking control of your computer—yikes!

Put simply

Think of this as a waiter who accidentally delivers a secret recipe to the wrong table. If the waiter isn’t cautious, that recipe could be misused, leading to disastrous kitchen results! CVE-2026-20944 is an out-of-bounds read vulnerability that arises when Microsoft Office Word mishandles memory allocation, permitting an attacker to execute arbitrary code locally without proper authorization.

What to do

This vulnerability could allow an unauthorized attacker to run malicious code on your system, potentially paving the way for data theft or system compromise. Imagine someone gaining access to your documents, sensitive information, or even taking control of your computer—yikes! To protect against this vulnerability, update Microsoft Office to the latest version immediately—look for the patch addressing CVE-2026-20944. Additionally, regularly review and apply security updates to your software to keep vulnerabilities at bay! You've got this! Stay proactive with your updates and keep your systems secure! 🛡️

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00511 · 42.7th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-01-13T17:56Z
EPSS history
Timeline
  • 13 JAN 17:56Z
    Microsoft Word Remote Code Execution Vulnerability
    cvelistv5