CVE-2026-72972: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-72972 Overview

CVE-2026-72972 is a heap-based buffer overflow [CWE-122] in Microsoft Office Word that allows an unauthenticated attacker to execute arbitrary code over a network. Exploitation requires user interaction, typically opening a crafted Word document. Successful exploitation gives an attacker code execution in the context of the current user, enabling installation of malware, credential theft, and lateral movement. The vulnerability affects Microsoft 365 Apps, Microsoft 365 on macOS, Office 2019, Office 2021, Office 2024, and Word 2016 across x86, x64, and macOS builds.

Critical Impact
A single crafted Word document delivered by email, chat, or web download can trigger remote code execution on any unpatched Office endpoint, giving attackers a reliable initial access vector against enterprise users.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft 365 for macOS, Office 2019, Office 2021 LTSC, Office 2024 LTSC (Windows and macOS)
Microsoft Word 2016 (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-72972 published to the National Vulnerability Database
2026-09-09 - Last updated in the NVD database

Technical Details for CVE-2026-72972

Vulnerability Analysis

The flaw is a heap-based buffer overflow inside Microsoft Word's document parsing logic. Word allocates a heap buffer sized against attacker-controlled metadata in a crafted document, then writes past the buffer boundary when the actual object data exceeds that computed size. Corrupting adjacent heap structures allows an attacker to influence control-flow data such as vtables or function pointers used later during rendering.

Because Word processes documents automatically on open, the vulnerability is reachable without any privilege on the target system. The attacker only needs to convince a user to open a document, which is a routine action for office workers. The Preview Pane in Outlook has historically expanded the attack surface for similar Word parsing bugs.

Root Cause

The root cause is improper validation of length or count fields during heap allocation for an internal Word structure. When the parser trusts an attacker-supplied size and then copies a larger payload into the allocation, adjacent heap metadata and objects are overwritten. This class of defect is tracked as CWE-122: Heap-based Buffer Overflow.

Attack Vector

Delivery vectors include phishing emails with attached .doc or .docx files, links to documents hosted on attacker-controlled or compromised SharePoint and OneDrive sites, and drive-by downloads. Because the CVSS vector indicates network reach with required user interaction, opening or previewing the document triggers the vulnerable code path. Refer to the Microsoft CVE-2026-72972 Update Guide for vendor-authoritative details on the affected component and impact scope.

Detection Methods for CVE-2026-72972

Indicators of Compromise

Unexpected child processes spawned by winword.exe, particularly cmd.exe, powershell.exe, mshta.exe, rundll32.exe, or wscript.exe.
Word writing executable content to %TEMP%, %APPDATA%, or %PUBLIC% followed by process execution from those paths.
Outbound network connections from winword.exe to unfamiliar hosts shortly after a document is opened.
Crash dumps or Windows Error Reporting events referencing heap corruption in wwlib.dll or related Office modules.

Detection Strategies

Hunt for process lineage anomalies where Office applications spawn scripting or living-off-the-land binaries.
Inspect inbound email attachments and cloud storage uploads for Word documents containing malformed structures or embedded objects.
Correlate document-open telemetry with subsequent file writes, registry persistence, and network egress to identify exploitation chains.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office child processes and Office write of executable content.
Forward Sysmon process-creation, image-load, and network-connection events to a SIEM for correlation across endpoints.
Track EPSS trend data for CVE-2026-72972 to detect rising exploitation likelihood; the current EPSS probability sits below one percent but is above baseline for Office parsing bugs.

How to Mitigate CVE-2026-72972

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-72972 Update Guide to all Windows and macOS Office installations.
Prioritize patching for users who routinely open externally sourced documents, including finance, HR, legal, and executive assistants.
Verify Microsoft 365 Apps update channels are current and that click-to-run deployments have received the latest build.

Patch Information

Microsoft has published fixed builds for Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Word 2016. Consult the vendor advisory for the exact build numbers for each channel and architecture before validating deployment.

Workarounds

Configure Microsoft Office to open documents from the internet in Protected View and block macros in files originating from the internet.
Disable the Outlook Reading Pane for untrusted mailboxes until patches are deployed.
Enforce Office file-block policies that prevent opening legacy binary Word formats from untrusted locations.
Route inbound Office attachments through a sandbox or detonation service to identify malformed documents before delivery.

bash

# Example Group Policy registry keys to enforce Protected View and block macros
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security" /v VBAWarnings /t REG_DWORD /d 4 /f