CVE-2026-20948
Published: 13 January 2026
Summary
CVE-2026-20948 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 8.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-20948 is an untrusted pointer dereference vulnerability (CWE-822) affecting Microsoft Office Word. Published on 2026-01-13T18:16:22.327, it enables an unauthorized attacker to execute code locally and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
The vulnerability requires local access to the target system (AV:L) and low attack complexity (AC:L), with no privileges required from the attacker (PR:N) but user interaction necessary (UI:R), such as opening a malicious document. Successful exploitation grants the attacker arbitrary code execution in the context of the user, resulting in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H).
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20948.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2132
Vulnerability details
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct client-side RCE via malicious Office document maps to exploitation for client execution and malicious file user execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely flaw remediation for the untrusted pointer dereference vulnerability in Microsoft Office Word to eliminate the exploitable condition.
Malicious code protection scans and blocks malicious Office documents that exploit the untrusted pointer dereference to achieve local code execution.
Memory protection mechanisms like ASLR and DEP thwart exploitation of the untrusted pointer dereference even if the vulnerability remains unpatched.