Code execution via numeric truncation

Numeric truncation in Microsoft Office Word allows attackers to execute code locally via a crafted document opened in affected Office installs. Microsoft has disclosed only the weakness class: Word truncates a numeric value during document processing, and the vendor has not published the affected parser, field, or memory operation that turns the truncated value into code execution. Exploitation requires user interaction to open a malicious file and runs with the current user's rights; authoritative records reviewed on August 19, 2026 do not show preview-pane reachability, public exploit code, or in-the-wild exploitation for this CVE.