Description
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise | 16.0.1 – < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Office LTSC 2021 | 16.0.1 – < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Office LTSC 2024 | 16.0.0 – < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Office LTSC for Mac 2021 | 16.0.1 – < 16.106.26020821 | 16.106.26020821 |
| Microsoft | Microsoft Office LTSC for Mac 2024 | 16.0.0 – < 16.106.26020821 | 16.106.26020821 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
ChaitanyaHaritash/CVE-2026-21514_CVE-2026-21510 ★ 7 · May 4, 2026
CVE-2026-21514 & CVE-2026-21510 (Because MS-Office Fascinates me)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- WID-SEC-2026-0371 Microsoft Office: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 10, 2026
- NCSC-2026-0058 Kwetsbaarheden verholpen in Microsoft Office NCSC-NL (Netherlands) · Feb 10, 2026
- MSRC-CVE-2026-21514 Microsoft Word Security Feature Bypass Vulnerability Microsoft Security Response Center · Feb 10, 2026
References
- Microsoft Word Security Feature Bypass Vulnerability vendor-advisory patch