CVE-2026-78517: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-78517 Overview

CVE-2026-78517 is a heap-based buffer overflow [CWE-122] in Microsoft Office Word that allows an unauthenticated attacker to execute arbitrary code over a network. Exploitation requires a user to open a crafted document, but no privileges are needed on the target system. Successful exploitation compromises confidentiality, integrity, and availability of the affected host.

The flaw affects Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016 across x86, x64, and macOS builds. Microsoft published the advisory in the Microsoft Security Update Guide.

Critical Impact
Remote code execution in the context of the current user through a malicious Word document, enabling initial access, credential theft, and lateral movement.

Affected Products

Microsoft 365 Apps (Enterprise x86/x64) and Microsoft 365 for macOS
Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (Windows and macOS where applicable)
Microsoft Word 2016 (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-78517 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78517

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in Microsoft Word's document parsing logic. When Word processes a specifically crafted file, it writes attacker-controlled data past the bounds of a heap-allocated buffer. The overflow corrupts adjacent heap metadata or object pointers, which an attacker can leverage to hijack control flow and execute code in the context of the user opening the document.

Because Word is embedded across the Microsoft 365 and Office product family, the vulnerable parsing surface is shared across desktop and macOS builds. Preview panes and automatic content rendering broaden the potential trigger surface, though Microsoft's advisory lists the attack complexity as low and requires user interaction.

Root Cause

The defect is classified as [CWE-122] Heap-based Buffer Overflow. It stems from insufficient bounds checking when Word parses structured content within a document, allowing an attacker to supply oversized or malformed fields that exceed the destination buffer size. Refer to the Microsoft Security Update Guide for vendor technical details.

Attack Vector

An attacker delivers a weaponized .doc, .docx, or .rtf file through email, chat, cloud storage links, or a malicious website. When the victim opens the file in a vulnerable Word build, the parser triggers the overflow and executes attacker-supplied code with the user's privileges. No authentication is required on the target and the attack traverses the network via the document delivery channel.

Exploitation code is not publicly available in the Exploit-DB, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability has been described in prose only; no verified proof-of-concept has been published.

Detection Methods for CVE-2026-78517

Indicators of Compromise

winword.exe or Microsoft Word (macOS) spawning shell interpreters such as cmd.exe, powershell.exe, wscript.exe, bash, or osascript shortly after opening a document.
Unexpected child processes performing network connections, LOLBin execution, or writes to %APPDATA%, %TEMP%, or ~/Library/LaunchAgents.
Office document files with anomalous embedded objects or oversized structured storage streams delivered from external senders.

Detection Strategies

Hunt for Word processes crashing repeatedly (Application Error event ID 1000 referencing winword.exe), which can indicate exploitation attempts or unstable payloads.
Correlate document open events with subsequent process creation, script execution, and outbound connections to previously unseen infrastructure.
Inspect email and web gateways for Office files containing malformed OLE, RTF, or OOXML structures known to trigger parser overflows.

Monitoring Recommendations

Enable command-line and script-block logging on endpoints running Microsoft 365 Apps and Office 2016–2024.
Forward Office telemetry, Sysmon process creation, and EDR alerts to a central data lake for cross-source correlation.
Monitor for Attack Surface Reduction (ASR) rule triggers blocking Office child processes and Win32 API calls from Office macros.

How to Mitigate CVE-2026-78517

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows and macOS Office builds.
Enable Protected View and Office Application Guard for documents originating from the internet or email attachments.
Block delivery of Office documents from untrusted external sources at the mail gateway and enforce link rewriting for cloud-hosted files.

Patch Information

Microsoft addresses CVE-2026-78517 through the September 2026 security update cycle. Administrators should deploy the corresponding Click-to-Run or MSI updates for Microsoft 365 Apps, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016. macOS users should install the latest Microsoft AutoUpdate release. Consult the Microsoft Security Update Guide for build numbers and channel-specific packages.

Workarounds

Enforce Microsoft Defender Attack Surface Reduction rules to block Office applications from creating child processes and injecting into other processes.
Disable the Outlook and Explorer preview handlers for Word documents until patches are deployed.
Configure File Block policy in the Trust Center to prevent opening of legacy Word file formats from untrusted locations.

bash

# Configuration example: enable ASR rules to reduce Office exploitation surface
Add-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

Add-MpPreference -AttackSurfaceReductionRules_Ids `
  3B576869-A4EC-4529-8536-B80A7769E899 `
  -AttackSurfaceReductionRules_Actions Enabled