CVE-2026-21514: Microsoft Office Word reliance on untrusted inputs in security decision

CVE-2026-21514 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2026-02-10

Microsoft Word, a widely used word processing application, contains a security flaw that allows an attacker to bypass built-in security protections. By tricking a user into interacting with a malicious file, an attacker can gain elevated permissions on the victim's computer. This vulnerability is currently being exploited in the wild, posing a significant risk of unauthorized system access and data compromise.

Technologies: Microsoft Office, Microsoft Word. Vendors: Microsoft.

Quick answers

Is CVE-2026-21514 exploited in the wild?
Yes. CVE-2026-21514 is known to be exploited in the wild, first recorded on 10 February 2026. Treat it as urgent.
How severe is CVE-2026-21514?
Critical severity, with a CVSS score of 7.8, published 10 February 2026.
Which products and versions are affected?
Microsoft Word 365 Apps, LTSC 2021, LTSC 2024.
Is there a fix for CVE-2026-21514?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-21514 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-21514?
Check whether you run Microsoft Office or Microsoft Word at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Microsoft Office Word (CWE-807) where the application relies on untrusted inputs to make security decisions. This flaw allows an attacker to bypass security features locally, provided they can convince a user to perform a specific action, such as opening a specially crafted document. The vulnerability is classified as a Local Privilege Escalation (LPE) and has been confirmed by CISA to be exploited in the wild. Affected versions include Microsoft 365 Apps and Office LTSC 2021/2024 on both Windows and macOS. Users are advised to apply the security updates provided by Microsoft.

Affected products

  • Microsoft Office Word 365 Apps, LTSC 2021, LTSC 2024

Timeline

  • 2026-02-10: disclosed
  • 2026-02-10: advisory: Microsoft released vendor advisory and CISA added to KEV catalog
  • 2026-02-10: exploited: Confirmed by CISA KEV entry

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.