CVE-2026-108441: Microsoft 365 Apps Buffer Overflow

CVE-2026-108441 Overview

CVE-2026-108441 is a heap-based buffer overflow [CWE-122] in Microsoft Office Word. The flaw allows an unauthorized remote attacker to execute arbitrary code on a target system when a crafted document is opened. Microsoft published the advisory on October 15, 2026, covering Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021, and Office LTSC 2024.

The vulnerability requires user interaction, typically the opening of a malicious Word file delivered via email, web download, or network share. Successful exploitation yields code execution in the context of the current user, enabling follow-on actions such as credential theft, persistence, and lateral movement.

Critical Impact
Opening a weaponized Word document can grant attackers full code execution in the user context across supported Windows and macOS Office builds.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office LTSC 2021 (Windows x64/x86 and macOS)
Microsoft Office LTSC 2024 (Windows x64/x86 and macOS)

Discovery Timeline

2026-10-15 - CVE-2026-108441 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-108441

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in the document parsing logic of Microsoft Word. When Word processes a specially crafted file, insufficient bounds validation on a heap allocation permits data to be written past the allocated buffer. The overflow corrupts adjacent heap metadata or object pointers, which an attacker can leverage to redirect execution flow.

Because Word parses several complex binary and XML-based structures, including legacy .doc, OOXML .docx, and RTF content, the attack surface spans multiple parser code paths. Exploitation runs within the Word process and inherits the privileges of the signed-in user.

Root Cause

The root cause is improper validation of a size or offset field prior to a heap write operation during document parsing. The allocator receives a value derived from attacker-controlled fields in the document, and subsequent copies into the heap buffer are not re-checked against the true allocation length.

Attack Vector

The attack vector is network based with required user interaction. An attacker delivers a malicious Word file through phishing email, instant messaging, cloud file sharing, or a compromised web page. Once the recipient opens the document, Word parses the embedded structures and triggers the overflow. Protected View and Mark-of-the-Web reduce but do not eliminate exposure, since users commonly enable editing on documents from internal or trusted-looking sources.

No public proof-of-concept exploit or in-the-wild exploitation has been reported. Refer to the Microsoft Security Update Guide CVE-2026-108441 for parser-level technical details.

Detection Methods for CVE-2026-108441

Indicators of Compromise

Unexpected child processes spawned from winword.exe or Microsoft Word on macOS, including cmd.exe, powershell.exe, wscript.exe, rundll32.exe, or shell interpreters.
Word processes writing executables, scripts, or scheduled task artifacts to user-writable paths such as %APPDATA%, %TEMP%, or ~/Library.
Outbound network connections initiated directly by winword.exe to uncategorized or newly registered domains shortly after a document is opened.
Crash telemetry showing winword.exe access violations in heap management routines when opening .docx, .doc, or .rtf files.

Detection Strategies

Hunt for Office applications spawning living-off-the-land binaries using MITRE ATT&CK technique T1566.001 (Spearphishing Attachment) and T1204.002 (User Execution: Malicious File).
Correlate email gateway logs for inbound Word attachments with endpoint telemetry showing suspicious post-open behavior from the same user.
Flag macro-free Word documents that still trigger process injection or memory allocation anomalies, since this exploit does not require macros.

Monitoring Recommendations

Enable Windows Defender Attack Surface Reduction (ASR) rules that block Office child processes and process injection.
Forward Office telemetry, Sysmon process events, and EDR heap-corruption alerts to a central analytics platform for correlation.
Monitor for repeated Word crashes across users, which can indicate ongoing exploitation attempts or weaponized document distribution.

How to Mitigate CVE-2026-108441

Immediate Actions Required

Apply the October 2026 Microsoft security updates for all affected Office builds, including Microsoft 365 Apps, Office LTSC 2021, and Office LTSC 2024 on both Windows and macOS.
Confirm that Microsoft 365 Apps clients are on a serviced update channel and that update deferrals are not blocking distribution.
Prioritize patching for users who routinely process external documents, such as finance, HR, legal, and executive assistants.

Patch Information

Microsoft released fixes referenced in the Microsoft Security Update Guide CVE-2026-108441. Administrators should validate installed build numbers against the versions listed in the advisory for each channel and architecture.

Workarounds

Enforce Protected View and Office Protected View for files originating from the Internet, Outlook attachments, and unsafe locations.
Block or quarantine inbound .doc, .docx, and .rtf attachments from untrusted senders at the mail gateway until patches are deployed.
Deploy ASR rules to block Office applications from creating child processes and from injecting into other processes.
Instruct users to avoid clicking "Enable Editing" on unsolicited documents and to report suspicious attachments to the security team.

bash

# Enable key Microsoft Defender ASR rules via PowerShell
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A,`
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84,`
  3B576869-A4EC-4529-8536-B80A7769E899 `
  -AttackSurfaceReductionRules_Actions Enabled,Enabled,Enabled