CVE-2026-105715: Microsoft 365 Apps RCE Vulnerability

CVE-2026-105715 Overview

CVE-2026-105715 is an integer overflow vulnerability [CWE-190] in Microsoft Office Word that enables unauthenticated remote code execution. An attacker crafts a malicious document that triggers arithmetic wraparound during parsing, corrupting memory and redirecting execution. Exploitation requires user interaction, typically opening the weaponized file or previewing it in Office.

The flaw affects Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024 across Windows and macOS platforms. Microsoft published the advisory through the Security Update Guide and released fixes for all supported Office channels.

Critical Impact

Successful exploitation grants attackers code execution in the context of the current user, enabling malware deployment, credential theft, and lateral movement from a single opened document.

Affected Products

• Microsoft 365 Apps (Enterprise, x64 and x86)
• Microsoft 365 for macOS
• Microsoft Office LTSC 2021 and Office LTSC 2024 (Windows and macOS)

Discovery Timeline

• 2026-10-13 - CVE-2026-105715 published to NVD
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-105715

Vulnerability Analysis

The vulnerability resides in Microsoft Word's document parsing logic, where an arithmetic operation on attacker-controlled size or offset values wraps around the integer type's maximum value. The wrapped value then feeds a downstream allocation or copy operation, producing an undersized buffer that is subsequently overflowed with document contents.

Because the overflow occurs during parsing, the attacker controls both the triggering structure and the data written past the buffer. This positions the flaw as a reliable primitive for arbitrary code execution within the Word process. Microsoft classifies the issue as remotely exploitable because the malicious document can arrive by email, web download, or shared storage.

User interaction is required: the victim must open the document or render it in a vulnerable preview surface. The high attack complexity reflects additional conditions needed to reliably bypass mitigations such as ASLR and Control Flow Guard.

Root Cause

The root cause is an unchecked arithmetic computation on a length or count field read from the document stream. When the computed value exceeds the integer bounds, it silently wraps, violating the invariant that the subsequent buffer is large enough to hold the parsed data.

Attack Vector

An attacker delivers a crafted Word document through phishing, a malicious link, or a compromised file share. When the victim opens the file, the parser processes the malformed structure, triggers the overflow, and executes attacker-supplied shellcode or ROP chain with the user's privileges. No authentication is required on the target system.

No verified public proof-of-concept code is available for CVE-2026-105715 at the time of writing. Refer to the Microsoft Security Update Guide for the authoritative technical description.

Detection Methods for CVE-2026-105715

Indicators of Compromise

• Unexpected child processes spawned by winword.exe, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
• Office documents arriving from external senders containing unusually large or malformed OLE, RTF, or OOXML structures.
• Outbound network connections initiated by Word to previously unseen domains or IP addresses shortly after document open.
• Creation of executables, scripts, or scheduled tasks in user-writable paths such as %AppData% or %Temp% by the Office process.

Detection Strategies

• Hunt for process-ancestry chains where winword.exe is the parent of script interpreters or LOLBins used for payload staging.
• Inspect email gateways for attachments and links delivering .doc, .docx, .rtf, or .docm files from untrusted senders.
• Correlate document-open telemetry with subsequent memory-protection or exception events inside Office processes.

Monitoring Recommendations

• Enable Microsoft Defender Attack Surface Reduction rules that block Office from spawning child processes and from creating executable content.
• Forward Office telemetry, Sysmon process events, and EDR alerts to a central analytics platform for cross-correlation.
• Monitor patch compliance for Microsoft 365 Apps, Office 2021, and Office 2024 across Windows and macOS endpoints.

How to Mitigate CVE-2026-105715

Immediate Actions Required

• Apply the Microsoft security update for CVE-2026-105715 to all affected Office installations through Microsoft Update or your management platform.
• Enforce Protected View and Block macros from the internet policies to reduce exposure from inbound documents.
• Validate that Attack Surface Reduction rules restricting Office child-process creation are enabled in audit or block mode.

Patch Information

Microsoft published fixes through the Microsoft Security Update Guide covering Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021, and Office LTSC 2024. Confirm the installed build matches or exceeds the patched version listed in the advisory for each channel and architecture.

Workarounds

• Open untrusted documents in Protected View or Office for the web, which isolates parsing from the local user context.
• Use Group Policy to disable legacy file formats and block documents originating from the internet zone where feasible.
• Deliver security awareness guidance instructing users to avoid opening unsolicited Word attachments pending patch deployment.

# Example: enable ASR rule blocking Office from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a `
                 -AttackSurfaceReductionRules_Actions Enabled