CVE-2026-77898: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-77898 Overview

CVE-2026-77898 is a heap-based buffer overflow [CWE-122] in Microsoft Office that allows an unauthorized attacker to execute code over a network. The flaw affects multiple supported Office releases across Windows and macOS, including Microsoft 365 Apps, Office 2019, Office 2021, and Office 2024. Exploitation requires user interaction, typically opening a crafted document delivered through email or a web download. Successful exploitation grants attackers the ability to run arbitrary code in the context of the current user.

Critical Impact
Attackers can achieve remote code execution on a target host when a user opens a maliciously crafted Office document, potentially leading to full compromise of the user session.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)

Discovery Timeline

2026-09-08 - CVE-2026-77898 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-77898

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in Microsoft Office document parsing. When Office processes a specifically crafted file, it writes beyond the bounds of an allocated heap buffer. This out-of-bounds write can corrupt adjacent heap metadata or function pointers, giving an attacker control over program execution flow. Because Office is the parser, exploitation only requires that a user open a malicious document from any delivery channel. The flaw affects the shared Office code base across Windows and macOS, so both platforms are exposed until patched.

Root Cause

The issue is classified as [CWE-122] Heap-based Buffer Overflow. It stems from insufficient bounds checking when Office copies attacker-controlled data from a document structure into a fixed-size heap allocation. When the input length exceeds the allocation size, adjacent heap memory is overwritten. The high attack complexity indicates that reliable exploitation requires specific memory layout conditions or bypasses of heap mitigations such as ASLR and heap metadata protection.

Attack Vector

Remote attackers deliver a crafted Office document through phishing email, malicious website, cloud file share, or messaging platform. The victim must open the file in a vulnerable Office application to trigger parsing of the malicious content. No prior authentication to the target system is required. On successful exploitation, code executes with the privileges of the user running Office, enabling credential theft, lateral movement, or deployment of second-stage payloads.

No public proof-of-concept code has been released. Refer to the Microsoft Security Update CVE-2026-77898 advisory for vendor technical details.

Detection Methods for CVE-2026-77898

Indicators of Compromise

Office applications (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) spawning unusual child processes such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Unexpected outbound network connections initiated by Office processes shortly after a document is opened.
Office process crashes or exception events referencing heap corruption, followed by suspicious file writes to %TEMP% or %APPDATA%.
Inbound documents from untrusted senders containing embedded objects, unusual OLE streams, or malformed structures flagged by mail-gateway inspection.

Detection Strategies

Deploy behavioral endpoint detection rules that flag Office parent-child process anomalies aligned with MITRE ATT&CK T1566.001 (Spearphishing Attachment) and T1203 (Exploitation for Client Execution).
Enable Windows Defender Application Control or AppLocker policies to alert when Office spawns script interpreters or LOLBins.
Ingest Office telemetry, Windows Sysmon process and network events, and mail-gateway metadata into a centralized data lake for correlation across the delivery chain.

Monitoring Recommendations

Monitor for Office application crashes (Windows Error Reporting event ID 1000/1001) that reference the vulnerable modules and correlate with recently opened attachments.
Track Attack Surface Reduction (ASR) rule triggers, particularly the rule that blocks Office applications from creating child processes.
Alert on newly created scheduled tasks, run keys, or WMI subscriptions created within minutes of a user opening an Office document.

How to Mitigate CVE-2026-77898

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-77898 to all Windows and macOS Office installations.
Prioritize patching for high-risk user populations such as executives, finance, HR, and any staff who routinely process external documents.
Verify Click-to-Run channels for Microsoft 365 Apps are receiving updates and confirm the build number reflects the fixed release.

Patch Information

Microsoft has released security updates for Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021 LTSC, and Office 2024 LTSC. Consult the Microsoft Security Update CVE-2026-77898 entry for the specific build numbers and KB articles that apply to each product edition.

Workarounds

Enable Protected View and Office Application Guard to isolate documents originating from the internet or email attachments.
Enforce the Microsoft Defender Attack Surface Reduction rule that blocks Office applications from creating child processes (D4F940AB-401B-4EFC-AADC-AD5F3C50688A).
Block or quarantine inbound Office documents from untrusted senders at the email gateway, and disable macros for files sourced from the internet using the BlockContentExecutionFromInternet policy.

bash

# Configuration example: enable ASR rule to block Office from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Verify current ASR rule state
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids