CVE-2026-78514: Microsoft 365 Apps Use After Free Flaw

CVE-2026-78514 Overview

CVE-2026-78514 is a use-after-free vulnerability [CWE-416] in Microsoft Office Word that allows an unauthenticated attacker to execute arbitrary code over a network. Exploitation requires user interaction, typically by convincing a target to open a crafted Word document. The flaw affects multiple Microsoft Office products across Windows and macOS platforms, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Word 2016. Successful exploitation grants the attacker code execution in the context of the current user, enabling follow-on activity such as credential theft, lateral movement, or ransomware deployment.

Critical Impact
An attacker who crafts a malicious Word document can achieve remote code execution on the victim's system with the privileges of the user opening the file.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Word 2016 (x64 and x86)

Discovery Timeline

2026-09-08 - CVE-2026-78514 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78514

Vulnerability Analysis

CVE-2026-78514 is a use-after-free condition in the Microsoft Office Word document parser. Word retains a pointer to an object in memory after that object has been freed, then later dereferences or operates on the stale pointer during document processing. An attacker who controls the layout and lifecycle of that freed object can influence what memory the pointer references when it is reused.

Because the trigger lives inside document parsing logic, the attacker delivers the payload as a crafted .docx, .doc, or .rtf file. The vulnerability can be reached through email attachments, cloud file shares, or web downloads. Preview functionality in mail clients such as Outlook can also render Word content and expand the exploitation surface.

Root Cause

The root cause is improper object lifetime management within Word. A code path frees a heap object without invalidating all outstanding references. When Word later processes structured content in the document, it reuses that reference, dereferencing memory that may now hold attacker-controlled data. Precise heap grooming allows an adversary to place a crafted object at the freed address and hijack control flow.

Attack Vector

Exploitation follows a network-delivered, user-interaction workflow. The attacker crafts a malicious Word document and delivers it via phishing email, malicious link, or shared storage. When the victim opens the file, Word triggers the free-and-reuse sequence, giving the attacker code execution as the current user. No elevated privileges or prior authentication to the target system are required.

No verified public exploit code or proof-of-concept is currently available. See the Microsoft Security Update Guide for vendor-specific technical details.

Detection Methods for CVE-2026-78514

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Word processes making outbound network connections to unfamiliar domains or IP addresses shortly after a document is opened.
Creation of executable files, scripts, or scheduled tasks under user-writable paths (for example %APPDATA%, %TEMP%) immediately following Word activity.
Crashes or exception events in WINWORD.EXE associated with heap corruption during document open.

Detection Strategies

Hunt for process ancestry where Office applications spawn scripting or living-off-the-land binaries.
Correlate document open events with subsequent DNS queries, HTTP/S connections, or SMB traffic from the Office process.
Flag documents delivered from external sources that trigger macro or OLE-object loading combined with anomalous memory allocation patterns.
Alert on Office child processes writing to autorun locations or modifying persistence keys in the registry.

Monitoring Recommendations

Ingest Office telemetry, EDR process events, and email gateway logs into a central data lake for cross-source correlation.
Enable Attack Surface Reduction rules that block Office apps from creating child processes and from injecting into other processes.
Monitor for anomalous Office crash telemetry that could indicate exploitation attempts against unpatched hosts.

How to Mitigate CVE-2026-78514

Immediate Actions Required

Apply Microsoft's September 2026 security updates for all affected Office SKUs listed in the Microsoft Security Update Guide.
Prioritize patching of internet-facing users, executives, and any endpoints that routinely process external documents.
Reinforce phishing awareness and validate email gateway rules that scan and sandbox Office attachments.

Patch Information

Microsoft has published fixes through the standard Office update channels. Administrators should confirm that Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Word 2016 receive the corresponding September 2026 security update on both Windows and macOS. Refer to the Microsoft Security Update Guide for the exact build numbers.

Workarounds

Enforce Protected View and Office Application Guard for documents originating from the internet and email attachments.
Disable the Outlook preview pane for external mail to reduce automatic rendering of untrusted Word content.
Block or restrict opening of .doc, .docx, and .rtf attachments from untrusted senders at the mail gateway until patching completes.
Deploy Microsoft Defender Attack Surface Reduction rules that prevent Office applications from spawning child processes.

bash

# Example: Enable ASR rule to block Office apps from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled