CVE-2026-21514: Microsoft Office Word -- Reliance on Untrusted Inputs Privilege Escalation

Background

Microsoft Word is the most widely deployed word processor in the world, processing documents across enterprise and consumer environments at enormous scale. Its support for macros, OLE objects, and external content references makes it a persistent target for security research and threat actors alike.

CVE-2026-21514 is classified under CWE-807 (Reliance on Untrusted Inputs in a Security Decision) — Word’s security decision logic consults attacker-controllable data, resulting in an incorrect privilege evaluation that allows local privilege escalation. CISA added this to the KEV catalog on 2026-02-10 as part of the February Patch Tuesday batch.

Office document vulnerabilities are a primary malware delivery mechanism. Phishing campaigns routinely deliver malicious Word documents, and when a file-opening vulnerability also escalates privileges, the combined impact is substantially worse.

Technical Mechanism

CWE-807 (Reliance on Untrusted Inputs in a Security Decision) occurs when a security-sensitive decision (such as whether to execute code, load a library, or grant access) is made based on data that comes from an untrusted source or can be manipulated by the user.

' Conceptual pattern: Word macro security decision based on document property
Function IsTrustedDocument() As Boolean
    ' Bug: reads trust status from document metadata, which attacker controls
    Dim trusted As String
    trusted = ActiveDocument.CustomDocumentProperties("TrustLevel").Value
    Return (trusted = "Trusted")  ' attacker sets this property in crafted doc
End Function

Sub AutoOpen()
    If IsTrustedDocument() Then
        ' Executes with elevated trust based on untrusted document metadata
        Shell "cmd.exe /c <payload>", vbHide
    End If
End Sub

An attacker crafts a Word document with manipulated metadata or embedded data that Word’s security evaluation trusts, causing the application to perform a privilege-escalating operation that should require administrative elevation.

Real-World Exploitation Evidence

CISA’s KEV listing confirms active exploitation. Microsoft Office documents remain the most common malware delivery vector in enterprise environments. Combining file-based exploitation with privilege escalation is particularly effective for phishing campaigns — a user opens an innocuous-looking document, which simultaneously executes malicious code and escalates privileges, achieving full system compromise with a single user action.

Impact Assessment

• Local privilege escalation when opening a maliciously crafted Word document
• Combination of social engineering (document phishing) with automatic privilege gain
• Potential for SYSTEM-level access from standard user document interaction
• Attack chain requires only that a user open the crafted file
• High deliverability via email, SharePoint, and OneDrive sharing

Affected Versions

Remediation Steps

1. Apply the February 2026 Office/Word security updates immediately.
2. Enable automatic updates for Microsoft 365 / Office installations.
3. Configure Trust Center settings to block all macros from external documents.
4. Enable Protected View for documents from internet/email sources via Group Policy.
5. Train users to not enable macros or override Protected View prompts.
6. Deploy email filtering to scan Office documents for suspicious embedded content.

Detection Guidance

Log Sources: Windows Security Event Logs, Sysmon, EDR process creation telemetry.

IOCs: WINWORD.EXE spawning cmd.exe, PowerShell, or other processes; privilege escalation events following Word document opens; anomalous child processes from Office applications.

Sigma rule:

title: Microsoft Word Untrusted Input Privilege Escalation CVE-2026-21514
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: '\WINWORD.EXE'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection
level: high

Timeline

References

• NVD — CVE-2026-21514
• CISA KEV — CVE-2026-21514
• Microsoft MSRC — CVE-2026-21514