CVE-2026-77911: Microsoft 365 Apps Information Disclosure

CVE-2026-77911 Overview

CVE-2026-77911 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Word that enables an unauthenticated remote attacker to disclose sensitive information over a network. Exploitation requires user interaction, typically by opening a crafted document. The flaw affects multiple Microsoft Office and Microsoft 365 releases across Windows and macOS platforms. Successful exploitation exposes process memory contents, which can include pointers, document data, or other application state useful for chaining further attacks.

Critical Impact
An attacker who convinces a user to open a specially crafted Word document can read memory outside intended bounds and disclose confidential information from the Word process.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS, Microsoft Office 2019, Office 2021 LTSC (Windows and macOS), and Office 2024 LTSC (Windows and macOS)
Microsoft Word 2016 (x64 and x86)

Discovery Timeline

2026-09-08 - CVE-2026-77911 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-77911

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Microsoft Word's document parsing logic. When Word processes a maliciously crafted file, code reads beyond the boundary of an allocated buffer. The read operation returns adjacent memory contents to attacker-controlled processing paths, which can then be exfiltrated. Because the confidentiality impact is high while integrity and availability remain untouched, the primary risk is data disclosure rather than code execution. Disclosed memory can accelerate secondary exploitation by leaking Address Space Layout Randomization (ASLR) offsets or sensitive user content.

Root Cause

The root cause is missing or insufficient bounds checking during the parsing of a structured element inside a Word document, as classified under [CWE-125]. Microsoft has not publicly released the exact file structure at fault. The condition allows a read past the end of an in-memory buffer during document deserialization.

Attack Vector

The attack vector is network-based delivery of a crafted document via email, file share, collaboration platform, or web download. User interaction is required to open the file in a vulnerable Word client. No authentication is required against the target. Preview handlers and Protected View can also process untrusted content and expand the attack surface if disabled or bypassed. Refer to the Microsoft CVE-2026-77911 Advisory for vendor guidance.

Detection Methods for CVE-2026-77911

Indicators of Compromise

Inbound Word documents (.doc, .docx, .rtf) from untrusted senders that trigger unexpected WINWORD.EXE crashes or memory access exceptions.
Word processes making outbound network connections shortly after opening a document, which may indicate exfiltration of leaked memory content.
Windows Error Reporting (WER) entries referencing access violations in Word document parsing modules.

Detection Strategies

Deploy endpoint detection rules that flag WINWORD.EXE spawning scripting engines (powershell.exe, wscript.exe, cscript.exe) or performing anomalous network I/O after opening a document.
Inspect email gateways for Office documents containing malformed structures, unusual embedded objects, or macros that reference remote content.
Correlate document open events with subsequent DNS lookups or HTTP POST activity from Office processes.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules for Office child processes and monitor telemetry for rule triggers.
Forward Office telemetry, Sysmon process and network events, and WER crash data into a centralized SIEM for behavioral correlation.
Track Office application version inventory to identify hosts running unpatched builds of Word, Microsoft 365 Apps, and Office LTSC.

How to Mitigate CVE-2026-77911

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft CVE-2026-77911 Advisory to all affected Office and Microsoft 365 installations.
Enforce Protected View and Office File Block policies for documents originating from the internet or email attachments.
Educate users to avoid opening unsolicited Word documents and to report suspicious attachments.

Patch Information

Microsoft has published fixes through the Microsoft Security Response Center. Administrators should deploy the corresponding updates for Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Word 2016. Validate patch installation with winword.exe version verification and Microsoft Update history. See the Microsoft CVE-2026-77911 Advisory for build numbers and channel-specific guidance.

Workarounds

Keep Protected View enabled for files from the internet, unsafe locations, and Outlook attachments.
Use Office File Block policy to prevent opening legacy Word binary formats from untrusted sources until patches are deployed.
Disable the Windows Explorer preview pane for Office documents on high-risk endpoints.

bash

# Configuration example: enforce Protected View via registry (Word 2016+)
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f