CVE-2026-78503: Microsoft 365 Apps Information Disclosure

CVE-2026-78503 Overview

CVE-2026-78503 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Word that permits an unauthorized attacker to disclose information over a network. The flaw affects multiple Office builds including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Word 2016 across Windows and macOS. Exploitation requires user interaction, typically by opening a crafted document. Microsoft published guidance through the Microsoft Security Update Guide.

Critical Impact
A successful attacker can read memory beyond intended buffer boundaries in Word, exposing sensitive process data such as document contents, heap fragments, or memory addresses useful for chaining further attacks.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, Office 2024 LTSC (Windows and macOS)
Microsoft Word 2016 (x64 and x86)

Discovery Timeline

2026-09-08 - CVE-2026-78503 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-78503

Vulnerability Analysis

The vulnerability is an out-of-bounds read within Microsoft Word's document parsing logic. When Word processes a maliciously crafted file, the parser reads memory outside the bounds of an allocated buffer. The disclosed memory can include portions of documents held in the same process, heap metadata, or pointer values that undermine address-space layout randomization (ASLR). The confidentiality impact is high, while integrity and availability are unaffected. Because delivery occurs through document files, common vectors include email attachments, chat clients, cloud file shares, and web downloads. See the Microsoft Security Update Guide for vendor detail.

Root Cause

Out-of-bounds read conditions [CWE-125] typically arise when a length or offset field inside a document structure is trusted without validation against the actual buffer size. The Word parser reads past the intended boundary, returning adjacent memory to attacker-controlled logic that later exfiltrates or renders it.

Attack Vector

The attack vector is network-based with user interaction required. An attacker crafts a malicious Word document and delivers it via phishing, a hosted link, or a shared drive. When the victim opens the document in a vulnerable Word build, the parser triggers the out-of-bounds read and leaks in-process memory back to the attacker through document features that reflect content.

No verified proof-of-concept code is publicly available for CVE-2026-78503. Refer to the vendor advisory for authoritative technical detail.

Detection Methods for CVE-2026-78503

Indicators of Compromise

Inbound email attachments or download activity delivering .docx, .doc, .rtf, or .docm files from untrusted senders followed by Word process activity.
winword.exe spawning unexpected child processes, generating crash dumps, or making outbound network connections shortly after opening a document.
Anomalous DNS or HTTP requests originating from winword.exe that could indicate exfiltration of leaked memory content.

Detection Strategies

Correlate document open events with Word process telemetry to flag crashes, memory faults, or unusual module loads following file open operations.
Deploy YARA rules targeting malformed Office Open XML or RTF structures with length or offset fields that exceed the actual embedded data size.
Monitor email and web gateways for Word documents containing anomalous embedded object streams or oversized property records.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and injecting into other processes.
Ingest Office telemetry and endpoint process events into a centralized data lake for correlation with mail gateway and proxy logs.
Track outbound network connections initiated by winword.exe and alert on transfers to newly registered or low-reputation domains.

How to Mitigate CVE-2026-78503

Immediate Actions Required

Apply the Microsoft security update referenced in MSRC CVE-2026-78503 across all affected Windows and macOS Office installations.
Inventory endpoints running Microsoft 365 Apps, Office 2019, 2021, 2024, and Word 2016, and prioritize patch deployment for user workstations.
Enforce Protected View and Office File Block policies for documents sourced from the internet or email until patching completes.

Patch Information

Microsoft has released updates through standard servicing channels. Windows installations should receive fixes through Microsoft Update or Click-to-Run channel updates for Microsoft 365 Apps. Office for macOS installations should be updated through the Microsoft AutoUpdate tool. Confirm build numbers against the vendor advisory to validate patch application.

Workarounds

Enable Protected View for files originating from the internet, Outlook attachments, and unsafe locations.
Configure File Block policy through Group Policy to prevent opening legacy document formats, or force them to open in Protected View as read-only.
Restrict inbound Office document types at the mail gateway when sourced from external, low-trust senders.

bash

# Example Group Policy registry keys enforcing Protected View for Word
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f