CVE-2026-78511: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-78511 Overview

CVE-2026-78511 is a heap-based buffer overflow [CWE-122] in Microsoft Office Word that allows an unauthenticated attacker to execute arbitrary code over a network. Exploitation requires a user to open a crafted document, giving attackers a reliable phishing-driven entry point into enterprise environments. The flaw affects supported branches of Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Word 2016 across Windows and macOS. Successful exploitation compromises confidentiality, integrity, and availability at the level of the invoking user, and can serve as a foothold for lateral movement.

Critical Impact
A single malicious Word document can execute attacker-controlled code in the context of the current user across every supported Office channel, including 365 Apps on Windows and Office for macOS.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS, Microsoft Word 2016 (x64 and x86)
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)

Discovery Timeline

2026-09-08 - CVE-2026-78511 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78511

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in the Microsoft Word document parser. When Word processes a specially crafted file, an undersized heap allocation receives more data than its computed size, corrupting adjacent heap metadata and object pointers. Attackers can shape the heap so that overwritten data influences control flow, achieving arbitrary code execution in the Word process. Because Word runs with the interactive user's rights, code executes with the same privileges as the victim. The bug is reachable through common file-delivery vectors, including email attachments, cloud file shares, and web downloads rendered through the Word preview handler.

Root Cause

The root cause is improper validation of a length field during parsing of a structured Word document element. The parser trusts an attacker-controlled size when copying data into a fixed-size heap buffer, resulting in an out-of-bounds write on the process heap.

Attack Vector

Exploitation occurs over the network but requires user interaction. An attacker delivers a malicious .doc, .docx, .rtf, or embedded Office object and induces the user to open or preview it. No prior authentication to the target system is needed. Once the document is opened, code executes without further prompts. Public technical details and proof-of-concept code are not available at the time of publication. See the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-78511

Indicators of Compromise

winword.exe spawning shell interpreters such as cmd.exe, powershell.exe, wscript.exe, or mshta.exe
Word writing executable content to %TEMP%, %APPDATA%, or %PUBLIC% and subsequently launching it
Unexpected outbound network connections from winword.exe to newly observed or low-reputation domains
Crash dumps referencing heap corruption in Word modules following document open events

Detection Strategies

Hunt for parent-child process anomalies where Office applications spawn LOLBins or scripting engines shortly after document open
Alert on Word process memory access to lsass.exe or credential stores, which indicates post-exploitation activity
Correlate email gateway telemetry on inbound Office attachments with endpoint document-open events to isolate suspect files

Monitoring Recommendations

Ingest Microsoft Defender AV, Sysmon process, network, and file-write events into a centralized data lake for retrospective hunting
Monitor for disabled or bypassed Attack Surface Reduction (ASR) rules that block Office child processes
Track Office application crashes reported through Windows Error Reporting as potential exploitation attempts

How to Mitigate CVE-2026-78511

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-78511 across all Windows and macOS Office installations
Enforce Microsoft Defender ASR rule Block all Office applications from creating child processes in Block mode
Configure Protected View and Office File Block policies to open documents from the internet and email in isolated, read-only mode
Prioritize patching of endpoints belonging to high-risk roles such as executives, finance, HR, and IT administrators

Patch Information

Microsoft has released fixes through its standard update channels for Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, Office for macOS, and Word 2016. Deploy updates via Microsoft Update, Microsoft Autopatch, WSUS, Intune, or Configuration Manager. Refer to the Microsoft Security Update Guide for build numbers per channel.

Workarounds

Block inbound Office documents from external senders at the email gateway when patching cannot be completed immediately
Disable the Word preview handler in Windows Explorer and Outlook to prevent rendering of untrusted files
Restrict macro execution and legacy file formats such as .doc and .rtf through Group Policy or Intune configuration profiles

bash

# Enable ASR rule to block Office child processes (run as Administrator)
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Force Protected View for files from the internet
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Office\16.0\Word\Security\ProtectedView' `
                 -Name 'DisableInternetFilesInPV' -Value 0 -Type DWord