CVE-2026-78512: Microsoft 365 Apps RCE Vulnerability

CVE-2026-78512 Overview

CVE-2026-78512 is a numeric truncation error in Microsoft Office Word that enables remote code execution over a network. An unauthorized attacker can craft a malicious Word document that, when opened by a target user, executes arbitrary code in the context of the current user. The flaw affects a broad set of Office deployments including Microsoft 365 Apps, Office 2016, 2019, 2021, 2024, and standalone Word installations on both Windows (x86/x64) and macOS. The vulnerability is tracked under CWE-122: Heap-based Buffer Overflow, reflecting how the truncation defect leads to memory corruption on the heap during document parsing.

Critical Impact

Successful exploitation allows arbitrary code execution with the privileges of the user opening a crafted document, enabling initial access, lateral movement, and payload delivery.

Affected Products

• Microsoft 365 Apps (Enterprise, x86 and x64) and Microsoft 365 for macOS
• Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows x86/x64 and macOS variants)
• Microsoft Word 2016 (x86 and x64)

Discovery Timeline

• 2026-09-08 - CVE-2026-78512 published to the National Vulnerability Database
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78512

Vulnerability Analysis

The vulnerability is a numeric truncation error that occurs while Microsoft Word processes structured content inside a document. When a larger integer value (for example a 32-bit or 64-bit length field parsed from the file) is assigned to a smaller integer type used for buffer sizing, the upper bits are silently discarded. The truncated value is then used to allocate a heap buffer, while the original untruncated length drives subsequent copy operations. This mismatch produces a heap-based buffer overflow ([CWE-122]) that corrupts adjacent heap metadata and object pointers. An attacker who controls the corrupted region can steer execution to attacker-supplied shellcode or ROP gadgets, resulting in code execution under the identity of the user who opened the document.

Root Cause

The root cause is unsafe implicit conversion between integer widths inside Word's document-parsing routines. Length or count fields read from a crafted .doc, .docx, or related Office file are not validated before being narrowed, allowing an attacker to force an undersized allocation followed by an oversized write.

Attack Vector

Exploitation is network-based but requires user interaction: the target must open a specially crafted Word document delivered by email, chat, a shared file service, or a web download. No prior authentication to the victim system is required. Because the Preview Pane and Protected View handling can trigger parsing of untrusted content, well-crafted lures increase the likelihood of successful exploitation. The current EPSS probability is 0.819% (percentile 55.077), and no public proof-of-concept or in-the-wild exploitation has been confirmed at time of writing.

No verified public exploit code is available for CVE-2026-78512. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-78512

Indicators of Compromise

• Unexpected child processes spawned by winword.exe such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
• Word processes performing outbound network connections to uncategorized or newly registered domains shortly after a document is opened.
• Creation of executable files, scripts, or scheduled tasks in user-writable paths (%APPDATA%, %TEMP%, %LOCALAPPDATA%) immediately after document open events.
• Word process crashes or Windows Error Reporting entries referencing heap corruption in Office parsing modules.

Detection Strategies

• Hunt for anomalous parent-child relationships where Office applications spawn scripting or living-off-the-land binaries.
• Correlate document open telemetry with subsequent process, file, and network activity to identify weaponized attachments.
• Inspect inbound email attachments and shared documents for Office files with malformed structures or unusual embedded objects.

Monitoring Recommendations

• Enable and forward Microsoft Defender AntiVirus, Office telemetry, and Sysmon process and network events to a centralized analytics platform.
• Monitor Windows Error Reporting for repeated Office crash signatures indicative of exploitation attempts.
• Track email gateway logs for bursts of Office attachments from external senders targeting the same users or departments.

How to Mitigate CVE-2026-78512

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Security Update Guide across all affected Office and Microsoft 365 Apps deployments.
• Prioritize patching of internet-facing users, executives, and high-risk mailboxes that regularly receive external attachments.
• Verify update deployment status through Microsoft Intune, Configuration Manager, or your endpoint management tooling.

Patch Information

Microsoft has issued updates for Microsoft 365 Apps, Office 2016, 2019, 2021 LTSC, 2024 LTSC, and Word 2016 on Windows and macOS. Administrators should consult the Microsoft Security Update Guide for the specific build numbers and channels aligned with each product edition.

Workarounds

• Enforce Protected View and disable the Outlook Preview Pane for messages containing Office attachments from external senders.
• Configure Attack Surface Reduction rules to block Office applications from creating child processes and from injecting into other processes.
• Block or quarantine legacy binary Office formats (.doc, .dot, .rtf) at the email gateway when business use cases do not require them.
• Deliver targeted user awareness reminders about opening unsolicited Word documents until patching is complete.

# Example: enable ASR rule blocking Office apps from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled