CVE-2026-72973: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-72973 Overview

CVE-2026-72973 is a heap-based buffer overflow [CWE-122] in Microsoft Office Word that allows an unauthorized attacker to execute arbitrary code over a network. The flaw affects Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021, Office 2024, and Word 2016. Exploitation requires a user to open a crafted document, after which the attacker gains code execution in the context of the current user. Microsoft addressed the issue in its security update guide.

Critical Impact
Successful exploitation grants attackers arbitrary code execution on the victim endpoint with the privileges of the Office user, enabling malware deployment, credential theft, and lateral movement.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Word 2016 (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-72973 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72973

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Microsoft Word's document parsing logic. When Word processes a specially crafted file, it writes beyond the bounds of a heap-allocated buffer. This corrupts adjacent heap metadata or object pointers, which an attacker can shape to hijack control flow. The result is arbitrary code execution in the security context of the user running Word.

Because Office documents are a common delivery vector for phishing and initial access, this class of flaw is routinely weaponized. Impacted installations span every current Office SKU across both Windows and macOS, broadening the exposure. Attackers can trigger the bug remotely by delivering a malicious .doc, .docx, or RTF file through email, chat, or a web download.

Root Cause

The root cause is improper validation of length or size fields inside a Word document structure. Parsing code allocates a heap buffer based on one value, then copies data using an attacker-controlled size, leading to a classic [CWE-122] heap overflow. Overwritten heap chunks or vtable pointers provide a primitive for arbitrary code execution.

Attack Vector

An unauthenticated remote attacker crafts a malicious Word document and delivers it to a target. When the user opens the file, or in some cases previews it in Outlook or a file explorer, Word parses the malformed structure and triggers the overflow. Protected View mitigates the risk for internet-sourced files, but users who click "Enable Editing" bypass that protection.

No public proof-of-concept or in-the-wild exploitation has been documented for CVE-2026-72973 at the time of writing. Refer to the Microsoft Security Update Guide for CVE-2026-72973 for authoritative technical details.

Detection Methods for CVE-2026-72973

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE such as cmd.exe, powershell.exe, mshta.exe, rundll32.exe, or wscript.exe.
Word crashes with heap corruption faults in the Windows Application event log referencing WINWORD.EXE or wwlib.dll.
Newly created executables, DLLs, or scripts in %APPDATA%, %TEMP%, or %LOCALAPPDATA% immediately after a document is opened.
Outbound network connections initiated by WINWORD.EXE to uncommon or newly registered domains.

Detection Strategies

Hunt for process lineage where Office binaries execute LOLBins or scripting hosts, then perform file writes or network activity.
Alert on Office processes loading unusual modules or allocating executable heap regions consistent with shellcode staging.
Correlate email or web download telemetry with document open events to identify phishing-delivered payloads.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office from creating child processes and from injecting into other processes.
Ingest endpoint process, file, and network telemetry into a central data lake to support cross-source hunting for suspicious Office activity.
Monitor mail gateways for Office attachments containing unusual embedded objects, oversized structures, or non-standard OLE streams.

How to Mitigate CVE-2026-72973

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-72973 across all Windows and macOS Office installations.
Inventory Office deployments to confirm patch coverage on Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Word 2016.
Reinforce user awareness on opening unsolicited Word attachments, particularly from external senders.

Patch Information

Microsoft has released security updates for all affected products. Administrators should deploy updates through Microsoft Update, Microsoft 365 Apps update channels, WSUS, Intune, or Microsoft AutoUpdate for macOS clients. Track patch status against the CPE list published in the NVD record for CVE-2026-72973.

Workarounds

Enforce Protected View and Office Trusted Documents policies so files from the internet and email attachments open in a sandbox by default.
Block or restrict inbound Office document formats at the mail gateway when the sender or file origin is untrusted.
Configure Attack Surface Reduction to block Office applications from creating child processes and from creating executable content.

bash

# Enable ASR rules that reduce Office document exploitation impact
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `  # Block Office from creating child processes
  -AttackSurfaceReductionRules_Actions Enabled

Set-MpPreference -AttackSurfaceReductionRules_Ids `
  3B576869-A4EC-4529-8536-B80A7769E899 `  # Block Office from creating executable content
  -AttackSurfaceReductionRules_Actions Enabled