CVE-2026-69742: Microsoft 365 Apps RCE Vulnerability

CVE-2026-69742 Overview

CVE-2026-69742 is an integer overflow vulnerability [CWE-190] in Microsoft Office Publisher that permits remote code execution. An unauthenticated attacker can execute arbitrary code on a target system when a user opens a crafted Publisher document. The flaw affects Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Publisher 2016 across x86 and x64 builds. Successful exploitation grants the attacker code execution in the context of the current user, enabling further compromise of the endpoint. Microsoft published the advisory through the Microsoft Security Response Center.

Critical Impact
Remote code execution against workstations running Microsoft Office Publisher through a single malicious document opened by an end user.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC
Microsoft Publisher 2016 (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-69742 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-69742

Vulnerability Analysis

The issue is an integer overflow or wraparound [CWE-190] in Microsoft Office Publisher's document parsing logic. When Publisher processes a specially crafted file, an arithmetic operation on an untrusted size or count value wraps past the maximum representable integer. The truncated result is then used to allocate or index a buffer, producing an undersized allocation or out-of-bounds memory access. Attackers convert that memory corruption into arbitrary code execution in the Publisher process. Because Publisher runs with the calling user's privileges, the resulting foothold matches the interactive user's rights and can be used for persistence, credential theft, or lateral movement.

Root Cause

The root cause is missing or incorrect validation of size or length fields inside a Publisher file format structure before those values feed arithmetic used for memory allocation. When the computed size wraps, subsequent write operations exceed the allocated region.

Attack Vector

Exploitation requires user interaction. An attacker delivers a malicious .pub document via email, chat, cloud share, or a web download, then relies on the victim to open it. No prior authentication to the target is required, and the attack traverses the network via the delivery channel. The vulnerability affects both x86 and x64 Office installations. See the Microsoft Security Response Center advisory for vendor technical details.

// No public proof-of-concept is available at time of writing.
// See the Microsoft advisory for authoritative technical details.

Detection Methods for CVE-2026-69742

Indicators of Compromise

Unexpected child processes spawned from mspub.exe, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Publisher files (.pub) arriving from external senders, cloud storage links, or unusual email gateways.
Outbound network connections initiated by mspub.exe to non-Microsoft infrastructure shortly after document open.
New scheduled tasks, run-key entries, or Office add-ins created immediately after Publisher activity.

Detection Strategies

Hunt for process-tree anomalies where mspub.exe is the parent of scripting or LOLBin executables.
Alert on Publisher writing executable content (.exe, .dll, .js, .hta) to user-writable directories such as %APPDATA% or %TEMP%.
Correlate email or web-proxy telemetry showing inbound .pub files with subsequent Publisher execution on the receiving host.
Apply YARA and file-format inspection rules that flag malformed Publisher structures with abnormal size or count fields.

Monitoring Recommendations

Forward Sysmon process, file, and network events for Office binaries into your SIEM or data lake with retention of at least 90 days.
Track Office Trust Center configuration changes and Protected View disablement across the fleet.
Monitor Microsoft Defender ASR rule triggers, particularly rules that block Office child-process creation.

How to Mitigate CVE-2026-69742

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-69742 across all Office channels.
Block inbound .pub attachments at the mail gateway when Publisher is not a required business format.
Enforce Protected View and Office Attack Surface Reduction (ASR) rules that block child-process creation by Office applications.
Prioritize patching for users who routinely handle documents from external sources.

Patch Information

Microsoft has published updates for Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Publisher 2016. Deploy the fixes via Microsoft Update, WSUS, Intune, or your standard patch management pipeline. Confirm the update guide at the Microsoft Vulnerability Update for CVE-2026-69742 for the exact build numbers per channel.

Workarounds

Restrict or uninstall Microsoft Publisher on hosts that do not require it.
Configure File Block policy in the Office Trust Center to prevent opening .pub files, or force them to open in Protected View.
Use Group Policy to disable Publisher file associations for users who never need Publisher documents.
Train users to report and not open unsolicited Publisher files, and quarantine matching attachments at the email gateway.

bash

# Example: block Office applications from creating child processes via ASR (PowerShell)
Add-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a `
                 -AttackSurfaceReductionRules_Actions Enabled