# CVE-2026-21514: Microsoft Office Word reliance on untrusted inputs in security decision

Source: https://junglewise.ai/threats/cve-2026-21514-microsoft-office-word-reliance-on-untrusted-inputs-in-security  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-10. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-21514 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2026-02-10

Microsoft Word, a widely used word processing application, contains a security flaw that allows an attacker to bypass built-in security protections. By tricking a user into interacting with a malicious file, an attacker can gain elevated permissions on the victim's computer. This vulnerability is currently being exploited in the wild, posing a significant risk of unauthorized system access and data compromise.

Technologies: [Microsoft Office](https://junglewise.ai/threats/technologies/office), [Microsoft Word](https://junglewise.ai/threats/technologies/word). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-21514 exploited in the wild?** Yes. CVE-2026-21514 is known to be exploited in the wild, first recorded on 10 February 2026. Treat it as urgent.

**How severe is CVE-2026-21514?** Critical severity, with a CVSS score of 7.8, published 10 February 2026.

**Which products and versions are affected?** Microsoft Word 365 Apps, LTSC 2021, LTSC 2024.

**Is there a fix for CVE-2026-21514?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-21514 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-21514?** Check whether you run Microsoft Office or Microsoft Word at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in Microsoft Office Word (CWE-807) where the application relies on untrusted inputs to make security decisions. This flaw allows an attacker to bypass security features locally, provided they can convince a user to perform a specific action, such as opening a specially crafted document. The vulnerability is classified as a Local Privilege Escalation (LPE) and has been confirmed by CISA to be exploited in the wild. Affected versions include Microsoft 365 Apps and Office LTSC 2021/2024 on both Windows and macOS. Users are advised to apply the security updates provided by Microsoft.

## Affected products

- Microsoft Office Word 365 Apps, LTSC 2021, LTSC 2024

## Timeline

- 2026-02-10: disclosed
- 2026-02-10: advisory: Microsoft released vendor advisory and CISA added to KEV catalog
- 2026-02-10: exploited: Confirmed by CISA KEV entry

## Related threats

- [Microsoft Office Outlook user warning spoofing vulnerability](https://junglewise.ai/threats/cve-2026-124194-microsoft-office-outlook-missing-user-interaction-for)
- [Microsoft Office heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-122198-heap-based-buffer-overflow-in-microsoft-office-allows-an)
- [Microsoft Office heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-120003-heap-based-buffer-overflow-in-microsoft-office-allows-an)
- [Microsoft Office UI security feature bypass](https://junglewise.ai/threats/cve-2026-119998-product-ui-does-not-warn-user-of-unsafe-actions-in-microsoft)
- [Microsoft Office heap-based buffer overflow](https://junglewise.ai/threats/cve-2026-116717-heap-based-buffer-overflow-in-microsoft-office-allows-an)