CVE-2026-108429: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-108429 Overview

CVE-2026-108429 is a heap-based buffer overflow [CWE-122] in Microsoft Office Word. The flaw lets an unauthenticated attacker execute arbitrary code on a target system over a network when a user opens a crafted document. Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC are affected on both x64 and x86 builds.

The vulnerability requires user interaction, meaning a victim must open the malicious file or trigger it through the Office preview pane. Successful exploitation grants code execution in the context of the current user.

Critical Impact
Attackers can achieve remote code execution with the privileges of the logged-on user by delivering a weaponized Word document through email, web download, or file share.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2021 LTSC (x64 and x86)
Microsoft Office 2024 LTSC (x64 and x86)

Discovery Timeline

2026-10-15 - CVE-2026-108429 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-108429

Vulnerability Analysis

The flaw is a heap-based buffer overflow in the Word document parsing logic. Word allocates a heap buffer sized from attacker-controlled fields in a crafted document. The parser then writes more data into the buffer than the allocation can hold, corrupting adjacent heap metadata and object pointers.

An attacker uses this corruption to overwrite function pointers, virtual table entries, or object fields that are later dereferenced. The outcome is arbitrary code execution inside WINWORD.EXE under the user's security context. Because Office processes untrusted content from email attachments, SharePoint, and web downloads, the attack surface is broad across enterprise environments.

Root Cause

The root cause is improper validation of a length or count value during parsing of document structures on the heap, consistent with [CWE-122]. The code trusts a size field embedded in the file instead of bounding writes against the actual allocation. Technical specifics are limited in the Microsoft advisory; refer to the Microsoft CVE-2026-108429 Advisory for vendor details.

Attack Vector

Exploitation occurs over the network with low complexity and no privileges, but requires user interaction. The attacker delivers a malicious .docx, .doc, .rtf, or related Office file through phishing, a watering-hole site, or a file share. When the victim opens the document, or in some cases previews it in Outlook, the parser processes the malformed structure and triggers the overflow. No authentication to the target is required.

No public proof-of-concept or in-the-wild exploitation has been reported. The EPSS probability stands at 0.441%.

Detection Methods for CVE-2026-108429

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Word writing executable content or scripts into %APPDATA%, %TEMP%, or user-writable startup locations.
Outbound network connections initiated directly by WINWORD.EXE to uncategorized or newly registered domains.
Crashes of WINWORD.EXE with heap corruption exceptions logged in the Windows Application event log.

Detection Strategies

Hunt for Office applications spawning living-off-the-land binaries, aligned to MITRE ATT&CK T1566.001 and T1203.
Alert on documents arriving from external senders that contain embedded templates, OLE objects, or remote relationships.
Correlate Office crash telemetry with inbound email attachments to identify exploitation attempts, successful or failed.

Monitoring Recommendations

Collect process creation, image load, and network telemetry from endpoints running Microsoft 365 Apps and Office LTSC.
Monitor Microsoft Defender Attack Surface Reduction (ASR) rule events, specifically the rule blocking Office apps from creating child processes.
Review Exchange and secure email gateway logs for high-volume delivery of Office attachments to multiple recipients.

How to Mitigate CVE-2026-108429

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-108429 Advisory to all affected Office installations.
Prioritize patching on endpoints used by executives, finance, HR, and other high-risk recipients of external documents.
Enable Microsoft Defender ASR rules that block Office applications from creating child processes and injecting into other processes.

Patch Information

Microsoft has released updates for Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC through the standard Click-to-Run and MSI update channels. Administrators should validate that build numbers reflect the October 2026 security update across both x64 and x86 deployments. See the Microsoft CVE-2026-108429 Advisory for build details.

Workarounds

Enable Protected View and Office File Block policies for documents originating from the internet or untrusted locations.
Disable the Outlook preview pane for messages from external senders until patches are deployed.
Enforce the ASR rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A to block Office child-process creation across the fleet.

bash

# Enable the ASR rule that blocks Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled