CVE-2026-20948CWE-822

Microsoft Word Remote Code Execution Vulnerability

High · published January 13, 2026

CVSS v3.1
7.8
EPSS
1%
Percentile
47.9
In the wild
Unconfirmed
What it is

⚡ A sneaky pointer dereference in Microsoft Word could let attackers run their own code locally — a recipe for chaos! 🔥 Think of it like a restaurant that allows diners to write their own orders on the menu without checking if they’re valid. If a hacker gets in, they can demand anything they want from the kitchen! This vulnerability could allow an unauthorized attacker to execute arbitrary code on your system, potentially leading to data theft, system compromise, or even complete control over your machine. It's a digital catastrophe waiting to happen!

Put simply

Think of it like a restaurant that allows diners to write their own orders on the menu without checking if they’re valid. If a hacker gets in, they can demand anything they want from the kitchen! The issue arises from untrusted pointer dereferencing, which allows attackers to exploit Microsoft Office Word by running malicious code without proper authentication or authorization checks.

What to do

This vulnerability could allow an unauthorized attacker to execute arbitrary code on your system, potentially leading to data theft, system compromise, or even complete control over your machine. It's a digital catastrophe waiting to happen! To protect yourself, ensure you update Microsoft Word to the latest version as soon as a patch is released. Additionally, limit user access to Word documents and educate users to avoid opening suspicious files. You've got this! Stay vigilant and secure your systems—let's keep the bad guys at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00597 · 47.9th percentile
Weakness
CWE-822 · Untrusted Pointer Dereference
Published
2026-01-13T17:57Z
EPSS history
Timeline
  • 13 JAN 17:57Z
    Microsoft Word Remote Code Execution Vulnerability
    cvelistv5