CVE-2026-20944: 
vulnerability analysis and mitigation

CVE-2026-20944 is an out-of-bounds read vulnerability in Microsoft Office Word that allows an unauthorized attacker to execute code locally. Disclosed on January 13, 2026, as part of Microsoft's January 2026 Patch Tuesday, it affects Microsoft 365 Apps for Enterprise, Microsoft Office LTSC for Mac 2021 (versions before 16.105.26011018), and Microsoft Office LTSC for Mac 2024 (versions before 16.105.26011018). It carries a CVSS v3.1 base score of 8.4 (High), assigned by Microsoft (Microsoft MSRC, Feedly).

The vulnerability is classified as CWE-125 (Out-of-bounds Read), where Microsoft Office Word fails to properly validate memory boundaries when processing specially crafted Word documents, leading to a read operation beyond the allocated buffer. The attack vector is local (AV:L), with low attack complexity and no privileges or user interaction required, suggesting the Preview Pane can serve as an attack surface — allowing exploitation by simply previewing a malicious document without explicitly opening it. No public proof-of-concept or detailed technical write-up has been published as of the disclosure date (Microsoft MSRC, Feedly).

Successful exploitation results in complete system compromise, with high impact to confidentiality, integrity, and availability on the affected host. An attacker who exploits this vulnerability can execute arbitrary code in the context of the current user or application, potentially enabling data theft, installation of malware, or further lateral movement within the network. The Preview Pane attack vector is particularly notable as it lowers the exploitation barrier — a victim need only preview a malicious Word document rather than explicitly open and interact with it (Feedly).

Microsoft released security updates on January 13, 2026, addressing this vulnerability. Affected products should be updated to version 16.105.26011018 or later for Microsoft Office LTSC for Mac 2021 and 2024; Microsoft 365 Apps for Enterprise users should apply the latest updates via the Microsoft Security Response Center release page. As a temporary workaround until patching is complete, organizations should consider disabling the Preview Pane in Microsoft Office and exercise caution with Word documents from untrusted or unknown sources (Microsoft MSRC, Feedly).

CVE-2026-20944 was covered as part of broader January 2026 Patch Tuesday roundups by multiple security vendors and researchers, including Talos Intelligence, Zero Day Initiative, Qualys, CrowdStrike, Arctic Wolf, and Sophos, all noting the large patch batch of 114 vulnerabilities. The vulnerability received attention due to its high CVSS score and the Preview Pane attack vector, which lowers the exploitation barrier. No specific threat actor attribution or significant standalone commentary on this CVE was identified beyond its inclusion in Patch Tuesday summaries (Talos Intelligence, Zero Day Initiative, Qualys Blog).