Word OLE security bypass — CVE-2026-21514

CVE-2026-21514 is a Microsoft Word security feature bypass (CVSS 7.8) — an OLE trust bypass. A crafted document disables Word's OLE object/link protection enforcement so an embedded OLE object activates without a Protected View / Enable Content prompt. For OOXML, the rule matches word/settings.xml disabling OLE protection enforcement (oleLinkProtection / objectEmbedProtection with enforcement off) while the document embeds an OLE object — the actual exploit primitive, not the generic Ole10Native+payload dropper shape (which is convicted by the OFFICE_PACKAGE_* / ClamAV rules instead). It also matches the observed RTF-embedded Word package shape where webSettings.xml.rels contains a frame relationship to a local Windows diagnostics XML target, and the altChunk/RTF shape where a hidden \svb hex package contains DrsE2oDoc, graphicFrameDoc, and downRevStg drawing compatibility parts.