Microsoft Word OLE Security Feature Bypass
CVE-2026-21514 is a Microsoft Office Word security feature bypass vulnerability caused by reliance on untrusted inputs in a security decision. Available reporting indicates that a specially crafted malicious Word/Office document can bypass OLE mitigations in Microsoft 365 and Microsoft Office that are intended to protect users from dangerous COM/OLE controls and embedded objects. Multiple sources describe the issue as suppressing or bypassing the usual security warnings when a victim opens the document, thereby exposing COM/OLE functionality that can then be abused in follow-on exploitation. The vulnerability is triggered when a user opens the malicious Office file; Microsoft noted that the Preview Pane is not an attack vector. Reporting also notes observed in-the-wild exploitation and references use of LNK files in related attack chains.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small exploit-builder project with 4 files: a license, a README, and two Python scripts. It is not a scanner or detector; it generates malicious artifacts for a document-based exploit chain targeting CVE-2026-21514 and CVE-2026-21510. Structure and purpose: - README.md documents the intended exploit chain and experimentation notes. It describes a Protected View/SBX bypass component and an RCE component, including CLSID changes, XML/object changes, and possible DLL-to-CPL substitution. - gen_rtf.py builds exploit.rtf by inserting a UTF-16-style null-padded UNC/WebDAV path into a large hardcoded RTF/OLE blob. The embedded path is \\127.0.0.1@80/final.lnk, indicating the document is meant to cause retrieval of a remote LNK over port 80 via WebDAV-like UNC syntax. - make_lnk.py builds final.lnk from hardcoded hex templates plus a null-padded remote payload path. The referenced payload path is \\127.0.0.1\cc.dll. The script comments explicitly suggest generating the DLL with msfvenom using windows/meterpreter/reverse_tcp. Main exploit capabilities: - Generates a malicious RTF lure document. - Embeds a remote UNC/WebDAV path to a malicious LNK file. - Generates a malicious LNK that references a remote DLL payload over SMB/UNC. - Includes embedded HTML/JavaScript/ActiveX logic inside the LNK data, apparently to trigger file/URL handling and object loading behavior. - Supports straightforward operator customization by changing the hardcoded remote paths and replacing the DLL payload. Operationally, this is an exploit builder rather than a full delivery framework. The payload is basic and hardcoded, so OPERATIONAL is the best fit rather than WEAPONIZED. The code is clearly intended to achieve code execution on a vulnerable Windows/Office target by chaining remote file retrieval and DLL loading.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
69 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Microsoft Office logic vulnerability that bypasses Protected View and OLE restrictions, enabling malicious code execution and NetNTLM authentication request transmission from untrusted input.
A Microsoft Word security feature bypass vulnerability that suppresses normal security warnings when opening malicious Word documents, making it useful for spear-phishing attacks.
A Microsoft Word security feature bypass caused by reliance on untrusted input for security decisions, allowing an unauthenticated attacker to bypass local security features.
Unknown (listed as a trending Microsoft Windows CVE without details in the provided content).
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.