Microsoft Word type confusion enables local code execution

Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.

• Microsoft 365 Apps for Enterprise: versions beginning at 16.0.1 and below the applicable release identified by Microsoft Office Security Releases are affected. The record does not provide a literal fixed version for this branch.
• Microsoft Office 2019: versions beginning at 19.0.0 and below the applicable release identified by Microsoft Office Security Releases are affected. The record does not provide a literal fixed version for this branch.
• Microsoft Office LTSC 2021: versions beginning at 16.0.1 and below the applicable release identified by Microsoft Office Security Releases are affected. Microsoft Office LTSC 2024 is affected from 16.0.0 under the same condition.
• Microsoft Office LTSC for Mac 2021: versions from 16.0.1 through before 16.109.26051019 are affected. Microsoft Office LTSC for Mac 2024 is affected from 16.0.0 through before 16.109.26051019.
• Microsoft SharePoint Enterprise Server 2016: versions from 16.0.0 through before 16.0.5552.1002 are affected.
• Microsoft SharePoint Server 2019: versions from 16.0.0 through before 16.0.10417.20128 are affected.
• Microsoft SharePoint Server Subscription Edition: versions from 16.0.0 through before 16.0.19725.20280 are affected.
• Microsoft Word 2016: versions from 16.0.1 through before 16.0.5552.1000 are affected.

Branches not listed in the supplied affected data should not be assumed safe without separate verification.

Microsoft describes the flaw as access of a resource using an incompatible type, commonly called type confusion, in Microsoft Office Word. The record maps the issue to CWE-822, Untrusted Pointer Dereference. The record confirms local reachability but does not identify the specific input, document or file format, mis-typed object, or vulnerable code path. Its attack characterization indicates low complexity, no required privileges, and no separate user interaction. The internal component, memory layout, and exploitation sequence remain undisclosed.

The record classifies exploitation as local, with low complexity, no required privileges, and no user interaction. An attacker therefore still needs local access to an affected system; the record does not establish a network attack path. The supplied public_exploit field is false, and the GCVE enrichment returned during research records exploitation as none. These status fields do not prove that exploitation is impossible. No specific campaign, victim, or indicator is identified.

Successful exploitation could permit code execution on a local system through Microsoft Word or another affected component. The assessment records potential impact to confidentiality, integrity, and availability, but does not specify the attacker's resulting privileges, process context, or persistence capability. The recorded scope is unchanged, so the record does not establish impact across a separate security authority. A compromised host could potentially have data altered or services disrupted depending on execution context, but that is a possible consequence rather than a confirmed scenario. Office endpoints and SharePoint servers should be assessed separately because their version boundaries and operating roles differ.

Successful exploitation could allow an attacker to execute code on a local system running an affected component. The recorded impact includes potential compromise of confidentiality, integrity, and availability of data or services. Because the attack vector is local, exposure depends on the attacker obtaining local access to the system; the record does not establish a remote attack scenario. Remediation may require coordinated patching across Office endpoints, LTSC installations, Word 2016, and SharePoint servers. The record does not identify a breach, victim, or specific campaign.

1. Prioritize Microsoft security updates for every affected product and branch. For Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, use the corresponding release identified by Microsoft Office Security Releases; the available data does not provide a literal fixed version for these branches.
2. Update Microsoft Office LTSC for Mac 2021 and Microsoft Office LTSC for Mac 2024 to 16.109.26051019.
3. Update Microsoft SharePoint Enterprise Server 2016 to 16.0.5552.1002, Microsoft SharePoint Server 2019 to 16.0.10417.20128, and Microsoft SharePoint Server Subscription Edition to 16.0.19725.20280.
4. Update Microsoft Word 2016 to 16.0.5552.1000.
5. Verify the installed version on every endpoint and server after deployment. Do not assume that a fix for one Office or SharePoint branch automatically covers another branch.
6. The record does not provide a vendor-specific mitigation. If patching is delayed, apply local containment measures under the organization's standard process, but do not treat generic controls as a Microsoft-confirmed patch or mitigation.

1. Inventory endpoints and servers running Microsoft 365 Apps for Enterprise, Microsoft Office, Microsoft Office LTSC, Microsoft Word 2016, or Microsoft SharePoint Server.
2. Compare installed versions with the affected boundaries and fixed versions listed in affected_summary.
3. For branches using the Microsoft Office Security Releases channel, identify the actual installed update rather than inferring status from the product name or release year.
4. Review endpoint and server telemetry for unusual code execution from Office-related processes as a precaution. The record does not provide a known log event, IOC, or signature.
5. Do not treat the absence of such telemetry as proof of safety; confirm exposure through inventory and version checks.