CVE-2026-78510: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-78510 Overview

CVE-2026-78510 is a heap-based buffer overflow [CWE-122] in Microsoft Office Word that allows an unauthorized attacker to execute arbitrary code over a network. The flaw affects multiple supported Office releases, including Microsoft 365 Apps, Microsoft 365 for macOS, and Office 2016, 2019, 2021, and 2024 across x86, x64, and macOS builds. Successful exploitation grants the attacker code execution in the context of the current user, enabling malware installation, credential theft, and lateral movement.

Critical Impact
An unauthenticated remote attacker can achieve arbitrary code execution by delivering a crafted Word document, with no privileges required and no user interaction indicated in the CVSS vector.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft 365 for macOS
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (x86, x64, macOS)

Discovery Timeline

2026-09-08 - CVE-2026-78510 published to the National Vulnerability Database (NVD)
2026-09-09 - CVE-2026-78510 last updated in NVD
2026-09-10 - EPSS score recorded at 0.954%

Technical Details for CVE-2026-78510

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Microsoft Office Word's document parsing logic. When Word processes a specially crafted document, it writes data beyond the bounds of a heap-allocated buffer. This corruption can be shaped to overwrite adjacent heap metadata or object pointers, redirecting execution flow to attacker-controlled code.

Because the CVSS vector lists no user interaction, exploitation paths likely include the Outlook Preview Pane, WebDAV, or SMB-hosted documents processed automatically by Office components. Code executes in the security context of the user opening or previewing the file. On systems where users hold administrative rights, the attacker gains full control of the host.

Root Cause

The root cause is improper bounds validation in a Word file-format parser, mapped to [CWE-122] (Heap-based Buffer Overflow). A length field or embedded structure size in a crafted document is not correctly validated against the destination buffer, allowing an oversized copy operation into a heap allocation used during document rendering or object deserialization.

Attack Vector

Attackers deliver a weaponized .docx, .doc, or .rtf file through email attachments, phishing links, cloud file shares, or drive-by downloads. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, network-reachable document handlers such as Outlook preview, SharePoint indexing, or automated document conversion pipelines are viable delivery paths. Exploitation code and public proof-of-concept material are not currently listed for this CVE.

No verified proof-of-concept code is available. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-78510

Indicators of Compromise

Unexpected winword.exe child processes such as cmd.exe, powershell.exe, rundll32.exe, mshta.exe, or wscript.exe.
Word processes writing executable content to %APPDATA%, %TEMP%, or %PUBLIC% paths shortly after a document is opened or previewed.
Outbound network connections from winword.exe to untrusted hosts, particularly following receipt of an email attachment.
Crash events for winword.exe referencing heap corruption (c0000374) in Windows Application event logs.

Detection Strategies

Hunt for anomalous parent-child process chains originating from winword.exe and correlate with recent document opens.
Alert on Office applications loading unsigned DLLs or invoking scripting hosts and LOLBins.
Inspect inbound email attachments and SharePoint uploads for malformed Word documents using content disarm and reconstruction (CDR) tooling.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office child processes and Office from creating executable content.
Forward Sysmon Event IDs 1, 3, 7, and 11 from endpoints running Office to a SIEM for correlation.
Monitor winword.exe memory integrity through EDR telemetry, prioritizing hosts that process external documents.

How to Mitigate CVE-2026-78510

Immediate Actions Required

Apply the security updates listed in the Microsoft Security Update Guide for CVE-2026-78510 across all affected Office SKUs.
Prioritize patching endpoints exposed to external email flows, VDI sessions, and shared document processing services.
Enforce Protected View and Office Trust Center policies to block content originating from the internet and untrusted locations.

Patch Information

Microsoft has published fixes through the Microsoft Security Update Guide. Deploy the vendor-supplied updates for Microsoft 365 Apps, Microsoft 365 for macOS, Office 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC. Verify installation using Get-HotFix, Microsoft Intune compliance reports, or Configuration Manager update deployment status.

Workarounds

Disable the Outlook Reading Pane to prevent automatic rendering of email-borne documents until patches are deployed.
Configure Office File Block policies to prevent opening legacy Word formats from untrusted zones.
Enable ASR rule Block all Office applications from creating child processes (GUID D4F940AB-401B-4EFC-AADC-AD5F3C50688A) in Block mode.

bash

# Enable ASR: Block Office child process creation (PowerShell)
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Enforce Protected View for internet-sourced documents
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Office\16.0\Word\Security\ProtectedView' `
                 -Name DisableInternetFilesInPV -Value 0