Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
This update addresses a vulnerability that bypasses OLE mitigations in Microsoft 365 and Microsoft Office which protect users from vulnerable COM/OLE controls.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it.
Security updates
16.114.26101123 — https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac
16.0.14334.20974 — https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
https — https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
Vulnerabilities 1
-
High 7.8
Microsoft Office Word Security Feature Bypass Vulnerability
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
Revision history
-
#1
Information published.
-
#2
Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.
References
-
CVE-2026-108433 Microsoft Office Word Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108433
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss