CVE-2026-78504: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-78504 Overview

CVE-2026-78504 is a stack-based buffer overflow [CWE-121] in Microsoft Office Word that permits remote code execution. An unauthorized attacker can trigger the flaw by delivering a crafted document to a target user. The vulnerability affects multiple Office channels, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Word 2016 on Windows and macOS. Successful exploitation grants code execution in the context of the current user, enabling downstream actions such as credential theft, persistence, and lateral movement.

Critical Impact
A remote attacker who convinces a user to open a malicious Word document can execute arbitrary code with the privileges of the logged-in user across supported Windows and macOS Office builds.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS variants)
Microsoft Word 2016 (x64 and x86)

Discovery Timeline

2026-09-08 - CVE-2026-78504 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78504

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow in Microsoft Word's document parsing path. When Word processes a specially crafted file, unchecked input is written past the bounds of a fixed-size stack buffer. The overflow corrupts adjacent stack data, including saved return addresses and structured exception handler records, giving an attacker the primitives needed to redirect execution. Because Word runs with the privileges of the interactive user, successful exploitation yields code execution in that user context and provides a foothold suitable for follow-on attacker activity.

Root Cause

The root cause is improper validation of a length field or record boundary during Word document parsing, classified under [CWE-121] Stack-based Buffer Overflow. Word copies attacker-controlled bytes into a fixed-length stack buffer without enforcing the target buffer size. Microsoft has not published low-level technical details in the advisory, so the specific parser and record structure involved are not disclosed.

Attack Vector

Exploitation occurs over the network but requires user interaction. An attacker delivers the malicious document through email attachments, messaging platforms, cloud file shares, or web downloads. The victim must open the file in a vulnerable version of Word. Preview handlers can also expand the attack surface, since some Office rendering paths execute in response to selection rather than an explicit open action. No authentication is required on the target system, and no elevated privileges are needed to trigger the flaw. See the Microsoft Security Update CVE-2026-78504 advisory for vendor guidance.

Detection Methods for CVE-2026-78504

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, such as cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, or mshta.exe.
Word crashes accompanied by Windows Error Reporting entries referencing stack corruption or access violations in Office modules.
Inbound .doc, .docx, .rtf, or .docm files from untrusted senders that arrive shortly before anomalous endpoint activity.
Outbound network connections from WINWORD.EXE to previously unseen or low-reputation domains.

Detection Strategies

Hunt for Office applications writing executable content to %APPDATA%, %TEMP%, or user profile paths, followed by execution of those artifacts.
Correlate email gateway telemetry on macro-enabled or RTF attachments with endpoint process creation events on the receiving host.
Alert on Office processes loading unusual DLLs or invoking WinHttp, UrlMon, or BITS APIs outside of expected workflows.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and injecting into other processes.
Ingest Office telemetry, Sysmon process and image-load events, and mail gateway logs into a central analytics platform for cross-source correlation.
Track patch state for all Office channels and flag endpoints that continue to run pre-patch builds after the update window closes.

How to Mitigate CVE-2026-78504

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-78504 across all Office channels, including macOS builds.
Prioritize patching for users who routinely receive external documents, such as finance, HR, legal, and executive assistants.
Verify that Microsoft 365 Apps update channels are not paused or deferred beyond the fixed build.

Patch Information

Microsoft has released updates through the Microsoft Update Guide. Refer to the Microsoft Security Update CVE-2026-78504 entry for the specific build numbers that address the flaw across Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Word 2016 on Windows and macOS.

Workarounds

Open untrusted documents in Protected View and block editing until the file is validated.
Disable the Windows Explorer preview pane for Office file types to reduce automatic rendering exposure.
Enforce Attack Surface Reduction rules that prevent Office from spawning child processes and executing downloaded content.
Restrict inbound .rtf, .docm, and legacy binary Office formats at the mail gateway where business processes allow.

bash

# Configuration example: enable ASR rule to block Office child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A \
                 -AttackSurfaceReductionRules_Actions Enabled