CVE-2026-26110
Published: 10 March 2026
Summary
CVE-2026-26110 is a high-severity Type Confusion (CWE-843) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 38.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-26110 is a type confusion vulnerability (CWE-843), involving access of a resource using an incompatible type, affecting Microsoft Office. Published on 2026-03-10T18:18:39.480, it carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
The vulnerability can be exploited by an unauthorized local attacker with low complexity and no required privileges or user interaction. Successful exploitation allows the attacker to execute arbitrary code locally on the affected system, resulting in high impacts to confidentiality, integrity, and availability.
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26110.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10676
Vulnerability details
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Type confusion vulnerability in Microsoft Office enables arbitrary code execution via client-side exploitation (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2026-26110 by requiring timely installation of Microsoft patches to remediate the type confusion vulnerability in Office.
Provides memory safety mechanisms like ASLR and DEP to block arbitrary code execution from type confusion exploits in Microsoft Office.
Enforces validation of Office document inputs to prevent type confusion by ensuring compatibility with expected data types and structures.