External file path control in Microsoft Office Word enables local code execution

External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Microsoft identifies the following products and scopes as affected:

• Microsoft 365 Apps for Enterprise: starting at version 16.0.1 and below the boundary referenced by Microsoft's Office Security Releases guidance; listed platforms are 32-bit and x64-based Systems.
• Microsoft Office 2016: versions starting at 16.0.0 and below 16.0.5569.1002.
• Microsoft Office 2019: starting at version 19.0.0 and below the boundary referenced by Microsoft's Office Security Releases guidance; listed platforms are 32-bit and x64-based Systems.
• Microsoft Office 365 for Mac: the record marks version - as affected and provides no numeric version boundary.
• Microsoft Office LTSC 2021: starting at version 16.0.1 and below the boundary referenced by Microsoft's Office Security Releases guidance; listed platforms are 32-bit and x64-based Systems.
• Microsoft Office LTSC 2024: starting at version 16.0.0 and below the boundary referenced by Microsoft's Office Security Releases guidance; listed platforms are 32-bit and x64-based Systems.
• Microsoft Office LTSC for Mac 2021: the record marks version - as affected and provides no numeric version boundary.

The record provides no separate solution string. For branches using the Office Security Releases reference, or for Mac entries without a numeric boundary, consult Microsoft's corresponding release guidance instead of inferring one common fixed version.

Microsoft Office Word from Microsoft processes file names or paths that can be externally controlled. The flaw is classified as CWE-73, where attacker-controlled data may cause Word to use an untrusted path and lead to local code execution.

The available record describes a local attack vector with low complexity, no required privileges, and required user interaction. Public evidence does not identify the specific processing component, file format, path source, affected interface, or exact mechanism connecting path control to code execution. The evidence does not establish that the flaw is limited to one document type or one particular way of opening a file.

The attack is assessed as local, requires no prior authentication or privileges, has low complexity, and requires user interaction.

The supplied record does not identify a public exploit or an exploited campaign. Associated enrichment marks exploitation as none, but that status does not prove that exploitation is impossible or absent from every environment.

The flaw can lead to local code execution after user interaction with related content or activity, although the available evidence does not identify the user's exact action. The record describes high impacts to the confidentiality, integrity, and availability of the affected system.

Scope is marked as unchanged, so the documented impact remains within the same security authority rather than automatically crossing into another security domain. Successful code execution could nevertheless allow access to data or services available to the Word account. The evidence does not establish specific account privileges, persistence capability, or whether exploitation can spread to another system.

If successfully exploited, attacker code could run on the local device in the context of Word or the user, depending on the execution mechanism and account permissions. Possible consequences include data disclosure, data modification, or service disruption on the affected endpoint.

Actual risk depends on the user's permissions, endpoint protections, and how users interact with untrusted content or paths. The record does not confirm a breach, named victim, or specific distribution scenario.

1. Deploy Microsoft's security update for Word and each affected Office branch. The record confirms that a patch is available.
2. For Microsoft Office 2016, verify that the deployment is outside the affected range, defined as versions starting at 16.0.0 and below 16.0.5569.1002.
3. For Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024, use Microsoft's Office Security Releases guidance to identify the applicable release for each branch. Do not apply the Office 2016 boundary to these branches.
4. Update Microsoft Office 365 for Mac and Microsoft Office LTSC for Mac 2021 separately. The record provides no numeric boundary or specific fixed version for these Mac products.
5. After deployment, re-inventory Word across all endpoints, including the listed Windows architectures and relevant Mac installations. Treat any device that remains within affected_summary as unremediated.
6. The record does not document a Microsoft-confirmed workaround. Do not treat generic defensive measures as a substitute for updating.

1. Inventory all devices running Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Microsoft Office LTSC for Mac 2021.
2. Record the installed Word version, deployment architecture, and operating system for each device, then compare them with the affected boundaries in affected_summary and Microsoft's Office Security Releases guidance.
3. Confirm that the update has been deployed across the listed Windows 32-bit, Windows x64, and applicable Mac installations.
4. Endpoint alerts for unusual code execution associated with Word may be reviewed as a precaution. The available evidence provides no specific IOC, log event, or process pattern; absence of such telemetry does not prove that a system is safe.