{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability/$entity","id":"00000000-0000-0000-0000-0000c1e90ec6","releaseDate":"2026-10-15T07:00:00-07:00","cveNumber":"CVE-2026-108428","cveTitle":"Microsoft Office Word Remote Code Execution Vulnerability","releaseNumber":"2026-Oct","vulnType":"Security Vulnerability","latestRevisionDate":"2026-10-15T07:00:00-07:00","description":"<p>Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.</p>\n","cweList":["CWE-122: Heap-based Buffer Overflow"],"cweDetailsListForSearch":["cwe: CWE-122: Heap-based Buffer Overflow","cweUrl: https://cwe.mitre.org/data/definitions/122.html"],"unformattedDescription":"<p>Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.</p>","mitreText":"CVE-2026-108428","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2026-108428","publiclyDisclosed":"No","exploited":"No","latestSoftwareReleaseId":2,"latestSoftwareRelease":"Exploitation Less Likely","olderSoftwareReleaseId":0,"denialOfService":"N/A","tag":"Microsoft Office Word","issuingCna":"Microsoft","issuingCnaId":100000001,"severityId":100000001,"severity":"Important","impactId":100000005,"impact":"Remote Code Execution","langCode":"en-US","baseScore":"8.8","temporalScore":"7.7","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","vectorStringSource":"Microsoft","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":1,"cweDetailsList":[{"keys":["cwe","cweUrl"],"values":["CWE-122: Heap-based Buffer Overflow","https://cwe.mitre.org/data/definitions/122.html"]}],"articles":[{"articleType":"FAQ","description":"<p><strong>Is the Preview Pane an attack vector for this vulnerability?</strong></p>\n<p>No, the Preview Pane is not an attack vector.</p>\n","ordinal":10000},{"title":"Microsoft Office Word Remote Code Execution Vulnerability","articleType":"100000000","description":"<p>Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.</p>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>According to the CVSS metric, the attack vector is network (AV:N) and user interaction is required (UI:R). What is the target context of the remote code execution?</strong></p>\n<p>This attack requires a user to open a specially crafted file from the attacker to initiate remote code execution.</p>\n","ordinal":10000}],"revisions":[{"cveNumber":"CVE-2026-108428","version":1,"revisionDate":"2026-10-15T07:00:00-07:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published.</p>\n","unformattedDescription":"Information published.","notificationNeeded":false,"notificationSent":false,"sourceId":"90ad263c-5fc6-f111-aaae-000d3a5aa3a1"},{"cveNumber":"CVE-2026-108428","version":1.1,"revisionDate":"2026-10-15T07:00:00-07:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.</p>\n","unformattedDescription":"Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.","notificationNeeded":false,"notificationSent":false,"sourceId":"7dfa91cd-c1c8-f111-aaae-000d3a5aa3a1"}]}