The threat posed by CVE‑2026‑21509 stems from how Microsoft Office handles untrusted inputs during key OLE (Object Linking and Embedding)