Improper access control in Microsoft Office Word

#!/usr/bin/env python3
# verify_cve_2026_41101.py
# Audit Microsoft Word for Android versions against CVE-2026-41101.
# Input: CSV export from MDM/EMM/app inventory.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/file error

import csv
import re
import sys
from typing import Optional, Tuple

FIXED_VERSION = (16, 0, 19822, 20190)
TARGET_PACKAGES = {
    'com.microsoft.office.word',
}
TARGET_NAME_HINTS = (
    'word for android',
    'microsoft word',
)


def parse_version(v: str) -> Optional[Tuple[int, ...]]:
    if not v:
        return None
    nums = re.findall(r'\d+', v)
    if not nums:
        return None
    return tuple(int(x) for x in nums)


def compare_versions(a: Tuple[int, ...], b: Tuple[int, ...]) -> int:
    max_len = max(len(a), len(b))
    a2 = a + (0,) * (max_len - len(a))
    b2 = b + (0,) * (max_len - len(b))
    if a2 < b2:
        return -1
    if a2 > b2:
        return 1
    return 0


def row_matches_word_android(row: dict) -> bool:
    hay = ' '.join(str(v or '').strip().lower() for v in row.values())
    if any(pkg in hay for pkg in TARGET_PACKAGES):
        return True
    return any(hint in hay for hint in TARGET_NAME_HINTS)


def get_version_from_row(row: dict) -> Optional[str]:
    preferred = [
        'version', 'app_version', 'application_version', 'package_version',
        'installed_version', 'version_name', 'build', 'app build'
    ]
    lowered = {str(k).strip().lower(): v for k, v in row.items()}
    for key in preferred:
        if key in lowered and str(lowered[key]).strip():
            return str(lowered[key]).strip()
    for k, v in lowered.items():
        if 'version' in k and str(v).strip():
            return str(v).strip()
    return None


def get_device_name(row: dict) -> str:
    preferred = ['device', 'device_name', 'managed_device_name', 'hostname', 'serial', 'user']
    lowered = {str(k).strip().lower(): v for k, v in row.items()}
    for key in preferred:
        if key in lowered and str(lowered[key]).strip():
            return str(lowered[key]).strip()
    return 'unknown-device'


def main() -> int:
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 verify_cve_2026_41101.py <inventory.csv>')
        return 3

    path = sys.argv[1]
    try:
        with open(path, newline='', encoding='utf-8-sig') as f:
            reader = csv.DictReader(f)
            if not reader.fieldnames:
                print('UNKNOWN - CSV has no header row')
                return 2

            matched = 0
            vulnerable = []
            patched = []
            unknown = []

            for row in reader:
                if not row_matches_word_android(row):
                    continue
                matched += 1
                device = get_device_name(row)
                version_str = get_version_from_row(row)
                parsed = parse_version(version_str or '')
                if not parsed:
                    unknown.append((device, version_str or ''))
                    continue
                if compare_versions(parsed, FIXED_VERSION) < 0:
                    vulnerable.append((device, version_str))
                else:
                    patched.append((device, version_str))

    except FileNotFoundError:
        print(f'UNKNOWN - file not found: {path}')
        return 3
    except Exception as e:
        print(f'UNKNOWN - failed to parse CSV: {e}')
        return 2

    if matched == 0:
        print('UNKNOWN - no Microsoft Word for Android entries found in inventory')
        return 2

    fixed_str = '.'.join(str(x) for x in FIXED_VERSION)
    print(f'Checked {matched} Word for Android record(s); fixed version is {fixed_str}')

    if vulnerable:
        print('VULNERABLE')
        for device, version in vulnerable[:25]:
            print(f'  {device}: {version}')
        if len(vulnerable) > 25:
            print(f'  ... and {len(vulnerable) - 25} more vulnerable record(s)')
        if unknown:
            print(f'  Note: {len(unknown)} matching record(s) had unknown version data')
        return 1

    if patched and not unknown:
        print('PATCHED')
        for device, version in patched[:10]:
            print(f'  {device}: {version}')
        if len(patched) > 10:
            print(f'  ... and {len(patched) - 10} more patched record(s)')
        return 0

    print('UNKNOWN')
    if patched:
        print(f'  {len(patched)} matching record(s) are at or above {fixed_str}')
    if unknown:
        print(f'  {len(unknown)} matching record(s) are missing usable version data')
        for device, version in unknown[:10]:
            display = version if version else '<empty>'
            print(f'  {device}: {display}')
    return 2


if __name__ == '__main__':
    sys.exit(main())