CVE-2026-70130

The CVSS 8.4/EPSS 0.0035 gap in CVE-2026-70130 isn't an anomaly — it's a documented pattern. Office parsing vulnerabilities with heap-based buffer overflows consistently show this disconnect: CVSS inflates theoretical impact while EPSS underweights Office-specific targeting that doesn't generate broad exploit database activity. The historical record is unambiguous — CVE-2017-0199, CVE-2017-11882, and CVE-2018-0802 all followed identical trajectories: low initial EPSS scores, confirmed active exploitation within 60-90 days, retroactive certainty that defenders 'should have known.' The descriptor 'local code execution' is doing deceptive work. It narrows the attacker capability requirement but says nothing about blast radius. A heap overflow in Outlook's attachment parser touches every inbound email. One in Excel's formula evaluator only activates when a file opens. The 'local' qualifier describes the exploit mechanism, not the propagation topology. If weaponized documents travel through email, SharePoint, and Teams — and they do — the cascade potential has nothing to do with the EPSS probability score. The institutional failure is more dangerous than the vulnerability itself. When defenders accept a low-EPSS verdict, they stop instrumenting detection, relax macro restrictions, and deprioritize monitoring around the affected component. The code paths surrounding the overflow — legacy VBA contexts, OLE automation endpoints, deprecated file format handlers — become forgotten attack surface. No CVE will ever describe them because they've existed too long to be noticed. The actionable question isn't whether CVSS is inflated or EPSS is blind — it's whether your organization can absorb the compounding cost of another 60-90 day exploitation window on a known bug class. The patch status and exact affected component matter, but the pattern is established: for heap-based Office parsing vulnerabilities, low EPSS has historically meant 'not yet weaponized' rather than 'not worth weaponizing.' Prioritize accordingly.

Reviewed through automated stages and approved by a human before publication.