CVE-2026-58651: MS Office Word Buffer Overflow Flaw

CVE-2026-58651 Overview

CVE-2026-58651 is a heap-based buffer overflow vulnerability in Microsoft Office Word that enables local code execution. The flaw is categorized under [CWE-122] and carries a CVSS 3.1 base score of 7.8. Exploitation requires user interaction, typically by opening a specially crafted document, but does not require prior authentication. Successful exploitation grants an attacker the ability to execute arbitrary code in the context of the current user, compromising confidentiality, integrity, and availability of the affected system. Microsoft published the advisory through its Security Update Guide on August 11, 2026.

Critical Impact
An attacker who convinces a user to open a crafted Word document can execute arbitrary code locally, resulting in full compromise of user data and processes.

Affected Products

Microsoft Office Word (see the Microsoft Security Update Guide for the authoritative list of affected builds)
Microsoft Office installations that include the Word component
Any supported Windows platform running a vulnerable Word build

Discovery Timeline

2026-08-11 - CVE-2026-58651 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-58651

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] within Microsoft Office Word's document parsing logic. When Word processes a malformed document, it writes data past the bounds of a heap-allocated buffer. This corruption of adjacent heap metadata or object pointers can be leveraged to hijack control flow. Because Word runs in the context of the invoking user, code executed through this flaw inherits that user's privileges and access to files, network resources, and cached credentials. The flaw does not cross a privilege boundary on its own, but it is a common initial-access primitive when chained with a local privilege escalation vulnerability.

Root Cause

The root cause is insufficient validation of size or length fields during the parsing of structured content inside a Word document. When the parser allocates a heap buffer based on one field and copies data governed by another, mismatched values allow writes beyond the allocation. Microsoft's advisory does not disclose the specific structure or code path. Refer to the Microsoft Security Update Guide entry for technical details.

Attack Vector

The attack vector is local (AV:L) and requires user interaction (UI:R). Typical delivery involves phishing emails carrying a weaponized .doc, .docx, .rtf, or embedded OLE object. Preview panes and automatic document handlers can also trigger parsing without an explicit open action. Once the document is rendered, the heap overflow executes attacker-controlled shellcode within the Word process. No verified public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2026-58651

Indicators of Compromise

Unexpected child processes spawned by winword.exe, such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe
Word processes performing outbound network connections to untrusted hosts shortly after document open
Creation of executable files, scripts, or scheduled tasks in user-writable paths following delivery of a Word attachment
Crash dumps or Windows Error Reporting events referencing heap corruption inside winword.exe

Detection Strategies

Hunt for process-lineage anomalies where winword.exe is the parent of interpreters, LOLBins, or unsigned binaries
Correlate email gateway telemetry for inbound Office documents with subsequent endpoint execution events on the same host
Alert on Office applications loading unusual DLLs or invoking Win32 APIs typical of shellcode staging

Monitoring Recommendations

Ingest Microsoft Defender, Sysmon, and EDR process telemetry into a central data lake for cross-host correlation
Enable Windows Attack Surface Reduction (ASR) audit mode for the rule that blocks Office child-process creation, and review triggered events
Track document-open events paired with heap corruption exceptions in application crash logs

How to Mitigate CVE-2026-58651

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Office installations
Prioritize patching endpoints belonging to users with elevated privileges or access to sensitive repositories
Block or quarantine inbound Office attachments from untrusted senders at the mail gateway pending patch deployment

Patch Information

Microsoft released a security update for CVE-2026-58651 on August 11, 2026. Administrators should deploy the update through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or their preferred patch management tooling. Confirm affected build numbers and click-to-run channels against the vendor advisory before scheduling maintenance windows.

Workarounds

Enable Protected View and Office Application Guard so untrusted documents are opened in an isolated container
Enforce Microsoft Defender ASR rules that block Office applications from creating child processes and from injecting into other processes
Disable the Outlook and File Explorer preview handlers for Word documents to prevent parsing without user consent
Restrict macro execution and block documents originating from the internet using Group Policy Mark-of-the-Web enforcement

bash

# Configuration example: enable ASR rules via PowerShell
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

# Block Office apps from injecting code into other processes
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled