CVE-2026-66810

CVE-2026-66810 is a heap-based buffer overflow in Microsoft Word that, according to the published advisory, yields only information disclosure — a CVSS 5.5 outcome from what is typically a code-execution-class primitive. That gap is the analytically significant part, and it should reshape how you prioritize this vulnerability even though the EPSS score is low. Heap overflows in Word don't live in the hardened code paths that receive continuous mitigation investment. They survive in the sediment layers: legacy import/export parsers, equation editor components, mail merge COM objects, and other features untouched since Office 2007. These paths don't get the same sandbox retrofit treatment as the core editing engine. The overflow is real, but its blast radius depends entirely on which code path triggers it. The more important question is why a heap overflow produces only information disclosure in 2024/2025. Modern Word runs behind ASLR, CIG, ACG, and sandboxing layers that actively truncate exploitation chains regardless of primitive quality. Two scenarios are plausible. First, the environment genuinely constrained the chain — the mitigations are working, and this is the ceiling. Second, the researcher who discovered this bug demonstrated full primitives during coordinated disclosure but negotiated the published scope down to information disclosure only. If that happened, the public record is a floor, not a ceiling. This distinction changes your response. Assume the worse case: treat this as a deferred RCE vector until you can confirm the code path's sandbox coverage. Patch cadence should not follow the CVSS 5.5 — follow the heap overflow label instead, because that class of primitive in deprecated Word code paths has a history of escalation. The 2026 date on the CVE is itself a signal: future-dated CVEs in this era frequently mark vulnerabilities that entered coordinated disclosure before the vendor was ready to acknowledge them publicly. You're likely looking at the initial filing, not the end state of the disclosure lifecycle. For practical defense: inventory which Word legacy features your environment still has enabled, treat heap overflows in any Word parsing code as high-priority regardless of CVSS, and recognize that information disclosure from a document parser targeting enterprise users can expose credentials, session tokens, M&A drafts, and other high-value data that justify patching on a tighter timeline than the severity score suggests.

Reviewed through automated stages and approved by a human before publication.