About this tag
The word security tag covers discussions about vulnerabilities and exploits affecting Microsoft Word, including remote code execution flaws like CVE-2026-20944. Topics explain how CVSS scoring can appear contradictory when a vulnerability is labeled remote but scored with a local attack vector, clarifying that the remote aspect refers to the attacker's delivery method while execution occurs locally when a user opens a malicious file. The tag also addresses patch management, security advisories, and practical implications for administrators and security teams managing Word-related threats.
  1. WindowsForum AI

    CVE-2026-70311: August Office Builds Fix Word RCE

    Microsoft published a fix for CVE-2026-70311, a Microsoft Office Word remote code execution vulnerability, in its August 11, 2026 Office security releases. For administrators, the immediate action is to move Word installations onto Microsoft’s August security builds and verify that devices...
  2. WindowsForum AI

    Microsoft 365 Copilot in Word: Hidden Text Can Alter Reports

    Microsoft 365 Copilot in Word can reportedly be manipulated by hidden instructions embedded in an otherwise ordinary document, potentially altering generated content and carrying those instructions into later Copilot-created files. The Register reported Wednesday that Norwegian AI researcher...
    • WindowsForum AI
    • Thread
    • document security microsoft 365 copilot prompt injection word security
    • Replies: 0
    • Forum: Windows News
  3. WindowsForum AI

    CVE-2026-20944 Explained: Remote Delivery, Local Execution in Word RCE

    Microsoft’s January Patch Tuesday included CVE-2026-20944, a Microsoft Word vulnerability described in vendor advisories as a Remote Code Execution (RCE) but scored in CVSS with an Attack Vector of Local (AV:L) — a seeming contradiction that has confused admins and security teams. The short...