NVD Rates Microsoft Word Untrusted Pointer Flaw CVE-2026-70300 Critical With 9.8 CVSS Score

Microsoft has published an advisory for CVE-2026-70300, a remote code execution vulnerability in Microsoft Office Word. The flaw allows an unauthorized attacker to execute code over a network by exploiting an untrusted pointer dereference, according to the Microsoft Security Update Guide.

What happened

Microsoft released an official advisory detailing CVE-2026-70300, which impacts the Microsoft Office Word application. The vendor describes the issue as an untrusted pointer dereference that permits an unauthorized attacker to execute code remotely. This capability exists over a network connection, meaning the attacker does not need physical access to the target machine. The National Vulnerability Database lists the weakness under CWE-822, confirming the technical nature of the flaw.

Why it matters

The National Vulnerability Database assigns a CVSS score of 9.8 to this vulnerability, categorizing it as critical. This severity rating reflects the potential impact of the flaw as assessed by the NVD. Security operations teams must prioritize this issue because it affects a widely deployed productivity tool. The remote nature of the attack vector is noted in the advisory, highlighting the network-based risk for organizations using Microsoft Office.

Our take on the response

• Monitor internal networks for unusual traffic patterns originating from Word processes.
• Review endpoint detection logs for unexpected code execution attempts in document viewers.
• Verify that all Microsoft Office installations are receiving security updates promptly.
• Isolate systems showing signs of unauthorized remote code execution immediately.

What defenders should look for

Teams usually detect this type of activity by monitoring for unexpected process spawns from Word. Check whether document handling services are initiating network connections to unknown external hosts. Look for alerts indicating unauthorized code execution within the context of a document viewer. Defenders should also review logs for anomalous memory access patterns that suggest pointer manipulation. Containment moves typically involve isolating affected endpoints to prevent lateral movement.

Background: Lateral movement

Lateral movement is the process where an attacker navigates from one system to another within a network after initial access. They use stolen credentials or unpatched vulnerabilities to expand their reach. This tactic allows them to reach sensitive data or critical servers without triggering perimeter alarms, making internal monitoring the primary defense.

Read the full guide: Lateral Movement in Cybersecurity: Definition and Detection

What to do and how to stay safe: Microsoft

• Identify all systems running Microsoft Office Word within your environment.
• Review network logs for unusual outbound connections from Word processes.
• Ensure that endpoint detection tools are configured to flag unexpected code execution.
• Once the vendor provides an update, deploy it to all affected systems immediately.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-70300?

It is a remote code execution vulnerability in Microsoft Office Word caused by an untrusted pointer dereference.

How severe is this vulnerability?

The National Vulnerability Database rates it as critical with a CVSS score of 9.8.

Which product is affected?

Microsoft Office Word is the affected product, as stated in the Microsoft Security Update Guide.