CVE-2026-78502: Microsoft 365 Apps Information Disclosure

CVE-2026-78502 Overview

CVE-2026-78502 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Word that allows an unauthenticated attacker to disclose information over a network. Exploitation requires a user to open a maliciously crafted document. When triggered, the flaw permits Word to read memory beyond an intended buffer boundary, exposing potentially sensitive process data to the attacker. Microsoft has published a security update addressing the issue through its Microsoft Security Response Center (MSRC).

Critical Impact
Successful exploitation leaks confidential in-memory data from the Word process, which may include document contents, credentials, or pointers usable in follow-on attacks.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64) and Microsoft 365 for macOS
Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (Windows x86/x64 and macOS)
Microsoft Word 2016 (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-78502 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-78502

Vulnerability Analysis

The vulnerability is an out-of-bounds read in Microsoft Word's document parsing logic. When Word processes a specially crafted file, it reads memory outside the bounds of an allocated buffer. This behavior falls under CWE-125 (Out-of-bounds Read) and results in information disclosure rather than code execution. The impact is limited to confidentiality; integrity and availability of the target system are not affected.

Exploitation is network-accessible in the sense that a malicious file can be delivered by email, web download, or shared workspace. However, user interaction is required — the victim must open the crafted document in a vulnerable Word build. No privileges are required on the target system prior to exploitation.

Root Cause

The root cause is missing or incorrect bounds validation in a document parsing routine. When Word interprets a malformed structure inside a Word document, it dereferences an offset or length field without confirming that the resulting read stays within the allocated buffer. Adjacent process memory is returned to attacker-controlled parsing paths, which can then be exfiltrated through the document rendering flow.

Attack Vector

An attacker crafts a malicious Word document and delivers it to a target through phishing, a web link, or a collaboration platform. When the user opens the document, Word parses the malformed content and reads out-of-bounds memory. Leaked data may include heap contents, session artifacts, or memory addresses that support subsequent exploitation. The vulnerability affects Word on Windows and macOS across all currently supported Office channels.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.692%.

Detection Methods for CVE-2026-78502

Indicators of Compromise

Inbound email attachments or downloaded .doc, .docx, .rtf, or .docm files from untrusted senders that trigger Word crashes or unusual child process activity.
winword.exe or Microsoft Word.app generating unexpected network egress shortly after opening a document.
Windows Error Reporting entries referencing access violations in Word document parsing modules.

Detection Strategies

Monitor endpoints for anomalous winword.exe behavior, including memory access faults, unexpected file reads, and outbound connections initiated from Word.
Inspect inbound Office documents at the mail gateway using sandbox detonation to identify malformed structures that trigger out-of-bounds reads.
Correlate document open events with subsequent authentication or data-access anomalies that may indicate leaked credentials being reused.

Monitoring Recommendations

Enable command-line, process, and network telemetry for all Office applications and forward events to a central analytics platform.
Track Office version and build inventory to identify hosts still running pre-patch Word installations.
Alert on Word processes spawning scripting engines, network utilities, or opening files from unusual paths such as email temp directories.

How to Mitigate CVE-2026-78502

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update for CVE-2026-78502 advisory across all affected Office SKUs.
Prioritize patching for users who routinely open externally sourced documents, including finance, HR, and executive assistants.
Verify that Microsoft 365 Apps update channels are current and that macOS Office builds have received the corresponding update.

Patch Information

Microsoft has released updates for Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016. Refer to the Microsoft Security Update for CVE-2026-78502 for the specific build numbers per channel and platform. Managed environments should push updates via Microsoft Configuration Manager, Intune, or Microsoft AutoUpdate for macOS.

Workarounds

Enforce Protected View for documents originating from the internet and other untrusted locations to constrain parsing in a sandboxed context.
Block or quarantine Office documents from external senders at the mail gateway until patches are deployed fleet-wide.
Disable preview handlers for Word documents in Windows Explorer and Outlook to prevent parsing without an explicit open action.

bash

# Configuration example: enforce Protected View via Group Policy registry keys (Word 2016+)
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f