CVE-2026-70300 Overview
CVE-2026-70300 is an untrusted pointer dereference vulnerability in Microsoft Office Word that allows an unauthorized attacker to execute code over a network. The flaw affects Microsoft 365 Apps, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024 on both x86 and x64 architectures. The vulnerability is tracked under [CWE-822: Untrusted Pointer Dereference] and carries a network attack vector with no authentication or user interaction required. Microsoft published a security advisory on October 13, 2026.
Critical Impact
Remote attackers can achieve arbitrary code execution in the context of the current user by delivering a crafted Word document, with full confidentiality, integrity, and availability impact.
Affected Products
- Microsoft 365 Apps (Enterprise, x86 and x64)
- Microsoft Office LTSC 2021 (x86 and x64)
- Microsoft Office LTSC 2024 (x86 and x64)
Discovery Timeline
- 2026-10-13 - CVE-2026-70300 published to NVD and Microsoft releases security update
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-70300
Vulnerability Analysis
The vulnerability resides in Microsoft Office Word's document parsing logic. Word dereferences a pointer value sourced from attacker-controlled document data without validating that the pointer references legitimate program memory. When Word processes a malformed structure within a Word document, the parser consumes bytes supplied by the attacker and treats them as a valid memory address. Dereferencing that address yields attacker-chosen control over subsequent program state, which an attacker can convert into arbitrary code execution.
Exploitation runs code with the privileges of the user opening or previewing the document. On systems where users operate with administrative rights, the impact extends across the host.
Root Cause
The root cause is classified as [CWE-822: Untrusted Pointer Dereference]. Microsoft Office Word accepts a pointer-like value from untrusted document input and dereferences it without validation. The parser does not verify that the pointer references memory the application owns or that the referenced structure matches expected types.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction according to the CVSS vector. An attacker delivers a crafted Word document through email, a web download, a shared file service, or an SMB/WebDAV path. The vulnerability triggers during document processing, which includes rendering in the Preview Pane in some Outlook and Explorer configurations.
No verified proof-of-concept code or exploit samples are publicly available at the time of publication. Refer to the Microsoft Security Update for CVE-2026-70300 for authoritative technical guidance.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-70300
Indicators of Compromise
- Word documents (.doc, .docx, .rtf) arriving from untrusted senders that trigger WINWORD.EXE to spawn cmd.exe, powershell.exe, wscript.exe, or mshta.exe.
- Unexpected child processes of WINWORD.EXE performing network connections to unknown hosts.
- Crash dumps or Windows Error Reporting entries referencing access violations in Office modules while opening Word content.
Detection Strategies
- Hunt for process-tree anomalies where WINWORD.EXE is the parent of script interpreters, LOLBins, or download utilities.
- Correlate inbound email attachments and web downloads containing Word documents with subsequent suspicious process execution on the same host.
- Monitor for Office processes writing executable content to user-writable paths such as %APPDATA%, %TEMP%, and %PUBLIC%.
Monitoring Recommendations
- Enable and forward Microsoft-Windows-Sysmon and Office telemetry to a centralized analytics platform for behavioral correlation.
- Alert on Office applications loading unsigned or newly observed DLLs, and on memory allocations with RWX protections inside WINWORD.EXE.
- Track email gateway detections for malformed Word documents and share verdicts with endpoint tooling for retrospective hunts.
How to Mitigate CVE-2026-70300
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update for CVE-2026-70300 to all affected Microsoft 365 Apps, Office LTSC 2021, and Office LTSC 2024 installations.
- Prioritize patching for internet-facing users, executives, and systems that process documents from external senders.
- Validate that Microsoft 365 Apps update channels are current and not deferred beyond the October 2026 release.
Patch Information
Microsoft published fixed builds alongside the advisory on October 13, 2026. Administrators should consult the Microsoft Security Update for CVE-2026-70300 to identify the correct build number for each channel (Current, Monthly Enterprise, Semi-Annual Enterprise) and for LTSC 2021 and 2024.
Workarounds
- Disable the Outlook Preview Pane and Windows Explorer preview handlers for Office documents until patching completes.
- Enforce Protected View and Block Macros from the Internet via Group Policy to reduce exposure to inbound documents.
- Deploy Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting into other processes.
# Example: enable ASR rules blocking Office child processes and executable content via PowerShell
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
Add-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 -AttackSurfaceReductionRules_Actions Enabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
