CVE-2026-77901: Microsoft 365 Apps RCE Vulnerability

CVE-2026-77901 Overview

CVE-2026-77901 is a null pointer dereference vulnerability [CWE-476] in Microsoft Office Word that allows an unauthorized attacker to execute code over a network. The flaw affects multiple Microsoft Office releases, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Word 2016 on Windows and macOS. Exploitation requires user interaction, typically opening a crafted document, and enables the attacker to compromise confidentiality, integrity, and availability on the target system.

Critical Impact
Successful exploitation lets an unauthenticated remote attacker run arbitrary code in the context of the user opening a malicious Word document.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Word 2016 (x64 and x86)

Discovery Timeline

2026-09-08 - CVE-2026-77901 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-77901

Vulnerability Analysis

The vulnerability is a null pointer dereference [CWE-476] in Microsoft Office Word. When Word parses a specifically crafted document, code paths dereference a pointer without validating that it has been initialized. Under attacker-controlled conditions, this dereference is redirected to influence program flow rather than simply crash the process. The result is remote code execution in the security context of the user who opens the document.

The issue is network-reachable because Word documents are routinely delivered through email, collaboration platforms, and web downloads. User interaction is required, so the attacker relies on social engineering to trigger the parsing routine.

Root Cause

The root cause is missing pointer validation inside a Word document parsing routine. A structure expected to be populated during document load remains uninitialized when the crafted content deviates from expected format assumptions. Subsequent code paths access members of that structure without a null check, allowing an attacker who controls surrounding memory layout to steer execution.

Attack Vector

An attacker crafts a malicious .doc or .docx file and delivers it to the victim through phishing, a shared drive, or a web link. When the user opens the document in a vulnerable Office version, the parser triggers the null pointer dereference and the attacker gains code execution with the user's privileges. No authentication to the target is required. See the Microsoft Security Update for CVE-2026-77901 for vendor technical details.

No verified proof-of-concept code is publicly available for this CVE.
Refer to the Microsoft Security Response Center advisory for authoritative technical details.

Detection Methods for CVE-2026-77901

Indicators of Compromise

Word processes (winword.exe) spawning unusual child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Unexpected outbound network connections initiated by winword.exe shortly after a document is opened.
Word crashes or exception events referencing access violations at null or near-null addresses in document parsing modules.
Newly written executables, scripts, or scheduled tasks created in user-writable paths immediately after document open events.

Detection Strategies

Alert on process lineage where winword.exe is the parent of scripting or living-off-the-land binaries.
Correlate email or web download telemetry with subsequent document open events and anomalous child process activity.
Hunt for Office application crashes in Windows Event Logs (Application log, event source Microsoft Office) that match parsing failure patterns.

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a centralized analytics platform to enable cross-source hunting.
Monitor macro-free document exploitation attempts, not just macro-enabled files, since this flaw does not require macros.
Track patch deployment coverage across all Office channels (Current, Monthly Enterprise, Semi-Annual, LTSC, and macOS builds).

How to Mitigate CVE-2026-77901

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory to all affected Office installations without delay.
Prioritize patching for users who routinely handle externally sourced documents such as finance, HR, legal, and executive assistants.
Reinforce user awareness about opening unsolicited Office documents received via email or chat.

Patch Information

Microsoft has published a security update through the Microsoft Security Response Center. See the Microsoft Security Update for CVE-2026-77901 for build numbers per channel and deployment guidance for Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Word 2016.

Workarounds

Enable Protected View and Office Application Guard so untrusted documents open in an isolated container.
Block or quarantine Office documents from external senders at the email gateway when they contain embedded objects or unusual formatting.
Configure Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and from injecting into other processes.

bash

# Example: Enable ASR rule to block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled