CVE-2026-78509: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-78509 Overview

CVE-2026-78509 is a heap-based buffer overflow [CWE-122] affecting multiple Microsoft Office products. An unauthenticated attacker can execute arbitrary code over a network without user interaction. The flaw impacts Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021 (including LTSC macOS), Office 2024 (including LTSC macOS), and Word 2016.

Microsoft published a security update through the Microsoft Security Response Center advisory. The vulnerability affects both x86 and x64 builds on Windows, as well as macOS installations.

Critical Impact
Remote code execution with no authentication and no user interaction across widely deployed Microsoft Office and Microsoft 365 products.

Affected Products

Microsoft 365 Apps (Enterprise x86 and x64) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows x86/x64 and macOS)
Microsoft Word 2016 (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-78509 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78509

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in Microsoft Office components shared across Outlook, Word, and Microsoft 365 Apps. An attacker who delivers a crafted document or message can trigger memory corruption during parsing. Successful exploitation yields arbitrary code execution in the context of the Office process.

Because the flaw is exploitable over a network without authentication or user interaction, it is well suited to phishing-style delivery through email or malicious file shares. The heap corruption pattern typical of [CWE-122] issues allows adversaries to overwrite adjacent object metadata, control function pointers, and pivot to code execution.

Microsoft has not published exploitation telemetry, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog at the time of writing. The EPSS probability is 0.954%.

Root Cause

The root cause is improper validation of length or size fields when Office parses structured document or message content. This causes a write beyond the boundaries of a heap-allocated buffer. Microsoft's advisory does not disclose the exact parsing routine involved.

Attack Vector

An attacker delivers a specially crafted Office file or message that reaches a vulnerable Office process. Parsing of the malicious content triggers the overflow. The advisory indicates network-based exploitation without prior authentication, consistent with delivery through email attachments, previewers, or file-sharing services. See the Microsoft Security Update CVE-2026-78509 advisory for vendor guidance.

Detection Methods for CVE-2026-78509

Indicators of Compromise

Office processes such as OUTLOOK.EXE, WINWORD.EXE, or macOS equivalents crashing during document or message rendering
Office processes spawning unusual child processes such as cmd.exe, powershell.exe, or wscript.exe
Outbound network connections initiated by Office processes to previously unseen infrastructure
Creation of persistence artifacts (scheduled tasks, Run keys, LaunchAgents) shortly after opening documents

Detection Strategies

Hunt for Office applications loading unsigned or unusual DLLs, and for heap corruption exceptions in Windows Error Reporting data
Correlate email delivery events with subsequent process execution anomalies from Office binaries
Flag Office child-process trees that touch script interpreters, LOLBins, or remote administration utilities

Monitoring Recommendations

Ingest Office application telemetry and Microsoft Defender ASR events into a centralized SIEM for correlation
Monitor mail gateway logs for attachments with suspicious Office file types or embedded objects
Track patch deployment status across Microsoft 365 Apps, Office 2019/2021/2024, and Word 2016 estates

How to Mitigate CVE-2026-78509

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-78509 advisory across all Windows and macOS Office installations
Prioritize patching internet-facing mail clients and shared workstations where Office documents are frequently opened
Verify that Microsoft 365 Apps update channels are current and that offline or air-gapped systems receive the update

Patch Information

Microsoft has released updates for Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021 LTSC (Windows and macOS), Office 2024 LTSC (Windows and macOS), and Word 2016. Consult the vendor advisory for the specific KB and build numbers matching each product and architecture.

Workarounds

Enable Protected View and Office Protected Processes for documents originating from the internet or email
Configure Attack Surface Reduction rules to block Office applications from creating child processes and injecting into other processes
Disable the preview pane in Outlook to reduce automatic rendering of malicious message content
Block or quarantine inbound Office file types at the email gateway pending patch deployment

bash

# Example: Enable ASR rules that limit Office abuse (run in elevated PowerShell)
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

Set-MpPreference -AttackSurfaceReductionRules_Ids `
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled