Reliance on Untrusted Inputs in a Security Decision in Microsoft Office - CVE-2026-88210
Published: October 14, 2026
Vulnerability identifier: #VU155399
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-88210
CWE-ID: CWE-807
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass Office macro policies used to block untrusted or malicious files.
The vulnerability exists due to reliance on untrusted inputs in a security decision in Microsoft Office Word when evaluating inputs for macro policy enforcement. A remote attacker can supply untrusted inputs to bypass Office macro policies used to block untrusted or malicious files.
User interaction is required, and the Preview Pane is an attack vector.
Affected software
Microsoft Office
How to mitigate CVE-2026-88210
Install security update from vendor's website.
Microsoft Office - update to 16.0.17932.21056