CVE-2026-108445: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-108445 Overview

CVE-2026-108445 is a stack-based buffer overflow vulnerability in Microsoft Office Word that allows an unauthenticated attacker to execute arbitrary code over a network. The flaw is tracked under CWE-121 and affects multiple supported editions of Microsoft Office, including Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC across Windows and macOS platforms. Exploitation requires user interaction, typically opening a crafted document, but no prior authentication to the target system. Successful exploitation yields high impact to confidentiality, integrity, and availability of the compromised host.

Critical Impact
An attacker who successfully exploits CVE-2026-108445 can execute code in the context of the current user, enabling malware installation, data theft, or lateral movement across enterprise environments.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2021 LTSC (Windows x64/x86 and macOS)
Microsoft Office 2024 LTSC (Windows x64/x86 and macOS)

Discovery Timeline

2026-10-15 - CVE-2026-108445 published to the National Vulnerability Database
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-108445

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] in the document parsing routines of Microsoft Office Word. When Word processes a specially crafted document, data copied into a fixed-size stack buffer exceeds its allocated bounds. The overflow overwrites adjacent stack memory, including saved return addresses and structured exception handler records. An attacker who controls the overflowed data can redirect execution flow to attacker-supplied shellcode or chain return-oriented programming (ROP) gadgets to bypass data execution prevention. Because the vulnerable code path executes during document rendering, exploitation requires only that the victim open or preview the malicious file.

Root Cause

The root cause is missing or insufficient bounds checking when parsing a specific document structure in Word's file format handlers. Field length values embedded in the document are trusted without validation against the destination buffer size. This allows attacker-controlled input to write past the end of the stack buffer during a copy operation.

Attack Vector

Exploitation occurs over a network with user interaction required. An attacker delivers a weaponized .doc, .docx, or .rtf file through phishing email, instant messaging, cloud share links, or compromised web downloads. When the target opens the file in a vulnerable version of Word, the parser triggers the overflow. The Office Preview Pane in Outlook may also serve as an exploitation surface. No elevated privileges are required on the attacker side, and the compromise executes with the privileges of the user running Word.

No verified public proof-of-concept code is available. See the Microsoft CVE-2026-108445 Update Guide for vendor technical details.

Detection Methods for CVE-2026-108445

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Outbound network connections initiated by WINWORD.EXE to unfamiliar domains or IP addresses shortly after document open.
Office documents arriving from external senders with embedded objects, unusual field codes, or malformed OLE structures.
Crash events or Windows Error Reporting entries referencing WINWORD.EXE with access violation exceptions.

Detection Strategies

Deploy behavioral endpoint detection rules that flag Office applications launching script interpreters or dropping executables to disk.
Enable Microsoft Office Attack Surface Reduction (ASR) rules and alert on blocked events, particularly rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A.
Correlate email gateway telemetry with endpoint document-open events to identify delivery chains for weaponized attachments.

Monitoring Recommendations

Ingest Office telemetry, Sysmon process creation events (Event ID 1), and network connection events (Event ID 3) into a SIEM for correlation.
Alert on anomalous memory operations and stack pivot behaviors associated with Office processes.
Monitor file-share and email-ingress channels for documents matching known malicious signatures or threat intelligence indicators tied to this CVE.

How to Mitigate CVE-2026-108445

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-108445 Update Guide to all affected Office installations.
Prioritize patching endpoints used by high-risk users such as executives, finance, and HR personnel who routinely process external documents.
Enable Protected View and Office Application Guard for documents originating from the internet or email attachments.
Block or quarantine inbound Office documents from untrusted senders at the email gateway until patch deployment is verified.

Patch Information

Microsoft has released security updates for Microsoft 365 Apps, Office 2021 LTSC, and Office 2024 LTSC on both Windows and macOS. Administrators should consult the Microsoft CVE-2026-108445 Update Guide for specific build numbers and deployment packages. Microsoft 365 Apps customers using Click-to-Run receive the fix through automatic update channels; verify update completion using Office Deployment Tool or Intune reporting.

Workarounds

Enforce Protected View for files originating from the internet, Outlook attachments, and potentially unsafe locations through Group Policy.
Disable the Outlook reading pane to prevent automatic rendering of weaponized attachments.
Configure Attack Surface Reduction rules to block Office child processes and Win32 API calls from Office macros.
Restrict Office file-type delivery at the email gateway using sender reputation and content inspection policies.

bash

# Example Group Policy registry keys to enforce Protected View in Word
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f