CVE-2026-58651

This heap overflow in Word's document parsing layer carries a 'local' classification that tells you almost nothing useful. The CVSS 7.8 score is identical whether this is a sandbox escape or a privilege escalation within the application—but the remediation implications are fundamentally different, and the CVE description obscures that distinction rather than clarifying it. The concrete question you need answered is this: does the vulnerable parsing code run in Word's sandboxed content process (the renderer that handles untrusted document content) or in the main Word process with full user-level privileges and its associated trust relationships? If it's the former, you're looking at a sandbox escape—serious, bounded, patched individually, and manageable through your patch deployment cadence. If it's the latter, you're looking at user-to-user privilege escalation with access to Microsoft 365 identity tokens, SharePoint/Teams integration, and credential stores. The blast radius differs dramatically, and the CVE description is silent on this. Here's what matters more than the classification: Microsoft has patched heap overflows in Office document parsing code in every year since at least 2016—often multiple per year, often the same structural pattern (bounds check missing in legacy format handler, triggered by crafted file). If this CVE is the fourth or fifth heap overflow in the same legacy format parser in two years, individual patches are treating symptoms while the structural condition—legacy format parsers maintained under feature pressure by non-systems engineers, persenting a persistent attack surface—goes unaddressed. Your priority actions: First, determine the execution context of the vulnerable code by examining the patch diff for architectural changes versus bounded memory safety fixes. Second, check your Microsoft Office patch history—if you're seeing multiple document parsing CVEs per quarter, treat this as a pattern indicator rather than an isolated incident. Third, if your environment permits, consider treating the Office content process as a permanently hostile boundary regardless of sandbox classification, given the documented reliability of parsing-layer escapes. The 'local' label is noise; the pattern is signal.

Reviewed through automated stages and approved by a human before publication.