CVE-2026-26110
Published: 10 March 2026
Description
Adversaries may exploit software vulnerabilities in client applications to execute code.
Security Summary
CVE-2026-26110 is a type confusion vulnerability (CWE-843), involving access of a resource using an incompatible type, affecting Microsoft Office. Published on 2026-03-10T18:18:39.480, it carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability can be exploited by an unauthorized local attacker with low complexity and no required privileges or user interaction. Successful exploitation allows the attacker to execute arbitrary code locally on the affected system, resulting in high impacts to confidentiality, integrity, and availability.
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26110.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Type confusion vulnerability in Microsoft Office enables arbitrary code execution via client-side exploitation (T1203).