high7.8Known exploited
CVE-2026-21514
Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-02-10. Federal due date: 2026-03-03.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | 365 Apps | All versions |
| Microsoft | Office Long Term Servicing Channel | Versions 2021, 2024 |