CVE-2026-21514: Microsoft Office Word Privilege Escalation Via Untrusted Input Validation Flaw

CVE ID: CVE-2026-21514 Vendor: Microsoft Product: Microsoft Office Word Vulnerability Class: Reliance on Untrusted Inputs in a Security Decision (CWE-807) Attack Vector: Local Patch Deadline (CISA KEV): 2026-03-03

Vulnerability Overview

Microsoft Office Word contains a flaw in which the application relies on untrusted user-controlled inputs when making internal security decisions. This allows an authenticated local attacker to escalate privileges on any Windows system running the affected software. Microsoft has assigned this vulnerability CVE-2026-21514, and CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies apply patches by March 3, 2026.

The vulnerability falls under CWE-807 (Reliance on Untrusted Inputs in a Security Decision), a class of flaw where an application uses attacker-influenced data to determine access control outcomes. When Word processes a crafted document, it fails to properly validate inputs before they influence a security-relevant decision — enabling privilege escalation without requiring the attacker to possess administrative credentials at the time of exploitation.

Technical Details

An attacker with standard, unprivileged local access to a Windows system can exploit this vulnerability by delivering a malicious Word document to the target user. Upon opening the document, Word processes the attacker-controlled input through a code path that gates a security decision — such as a permission check or access control enforcement — without adequately sanitizing or verifying the source of that input.

The result: the attacker's process or code executes at an elevated privilege level, effectively bypassing the principle of least privilege. No additional user interaction beyond opening the document is required once the file is accessed. The attack vector is local, meaning the attacker must already have a foothold on the target machine or rely on social engineering to deliver the document to an authenticated user.

Although Microsoft has not published a CVSS score in the source disclosure at time of writing, local privilege escalation vulnerabilities of this class typically score in the 7.3–7.8 (High) range under CVSSv3.1, with a low attack complexity and low privileges required.

This vulnerability class is operationally significant because it chains effectively with initial access techniques. An attacker who gains entry via phishing, a web-delivered payload, or a separate lower-severity vulnerability can use CVE-2026-21514 to move from a standard user context to local administrator or SYSTEM-level access — enabling credential harvesting, lateral movement, and persistence.

Real-World Impact

Microsoft Office Word is deployed across virtually every enterprise Windows environment. The attack surface is broad: any authenticated user who opens a weaponized .docx, .doc, or related Office file on an unpatched system is a viable target.

Privilege escalation from a low-privileged user context to local admin enables an attacker to:

  • Dump credentials from LSASS memory using tools such as Mimikatz or direct API calls from winword.exe
  • Disable endpoint defenses that require administrative rights to modify
  • Install persistent implants in locations inaccessible to standard users (e.g., HKLM registry hives, system directories)
  • Access sensitive files protected by NTFS ACLs enforced at the admin level

CISA's inclusion of this CVE in the KEV catalog indicates evidence of active exploitation or a high probability of imminent exploitation in the wild. Federal civilian executive branch (FCEB) agencies are legally required to remediate by March 3, 2026. Commercial organizations should treat the same deadline as an operational benchmark.

Detection Guidance

SOC analysts should implement the following detection logic on endpoints running Microsoft Office Word:

Process Behavior:

  • Alert on winword.exe spawning child processes with elevated integrity levels (e.g., Medium → High token elevation)
  • Monitor for winword.exe making direct access calls to lsass.exe (OpenProcess with PROCESS_VM_READ targeting LSASS)
  • Flag winword.exe writing to HKLM registry hives or dropping files to %SystemRoot%\System32

File-Based Indicators:

  • Inspect incoming Office documents for anomalous embedded objects, macros, or structured storage streams that reference external resources triggering input parsing

Privileged Access Monitoring:

  • Correlate token impersonation events (Event ID 4624 with Logon Type 9 or elevated token assignments) with active Word process sessions

Endpoint Detection and Response (EDR) platforms — including Microsoft Defender for Endpoint, CrowdStrike Falcon, and SentinelOne — should be queried for telemetry matching the above patterns across all managed assets.

Patching and Mitigation

Primary Remediation: Apply the Microsoft security update addressing CVE-2026-21514 as soon as it becomes available through Windows Update, Microsoft Update Catalog, or WSUS. Monitor the Microsoft Security Update Guide for the official patch release tied to this CVE.

Asset Identification: Use your EDR platform or CMDB to enumerate all Windows endpoints running any version of Microsoft Office Word. Prioritize systems where users operate with standard user accounts, as these represent the highest-risk exploitation targets given the local escalation path.

Compensating Controls (Pre-Patch):

  1. Restrict local administrator rights across end-user workstations. Remove unnecessary local admin privileges to reduce the post-exploitation impact window even if exploitation occurs.
  2. Enable Protected View in Microsoft Office group policy settings to prevent automatic execution of content from untrusted sources.
  3. Block untrusted macros via Group Policy (set macro execution to disabled or signed-only for documents originating outside the organization).
  4. Deploy Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint — specifically rules blocking Office applications from creating child processes and injecting code into other processes.
  5. Segment and monitor systems where Office document processing occurs in high-risk workflows (e.g., email gateways, shared drives receiving external files).

Federal agencies must comply with the CISA KEV remediation deadline of March 3, 2026. All other organizations should treat this as a high-priority patch cycle item given the broad deployment footprint of Microsoft Office Word and the operational leverage a local privilege escalation provides to attackers already inside an environment.