CVE-2026-78520: Microsoft 365 Apps RCE Vulnerability

CVE-2026-78520 Overview

CVE-2026-78520 is an out-of-bounds read vulnerability [CWE-125] affecting multiple Microsoft Office products, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Word 2016. An unauthorized attacker can leverage the flaw to execute code over a network when a user opens a crafted Office document. Exploitation requires user interaction but no prior authentication. Microsoft has published a security advisory and update through its Microsoft Security Response Center (MSRC).

Critical Impact
Successful exploitation permits remote code execution in the context of the current user after the victim opens a malicious Office file delivered by email, web, or file share.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS variants)
Microsoft Word 2016 (x64 and x86)

Discovery Timeline

2026-09-08 - CVE-2026-78520 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database
2026-09-10 - EPSS scoring published by FIRST

Technical Details for CVE-2026-78520

Vulnerability Analysis

The vulnerability stems from an out-of-bounds read [CWE-125] in Microsoft Office's document parsing logic. When Office processes a crafted file, the affected code path reads memory outside the bounds of an allocated buffer. Attackers can shape adjacent memory to influence subsequent control flow, enabling code execution in the user's session. The flaw is reachable over a network vector because Office documents are commonly delivered through email attachments, SharePoint, OneDrive, and web links. Because integrity and availability impacts are not required for the primary attack outcome, exploitation focuses on turning the memory disclosure and corruption into arbitrary execution.

Root Cause

The underlying defect is a missing or insufficient bounds check when the Office parser interprets a length or offset field from an untrusted document. When the field references data beyond the allocated structure, the parser reads adjacent memory. This condition matches the classic out-of-bounds read pattern documented in CWE-125.

Attack Vector

An attacker crafts a malicious Office document and delivers it to a target via phishing, a compromised website, or a shared file location. The victim must open the file for the parser to reach the vulnerable code path. Preview panes or automatic rendering features can also trigger the flaw depending on Office configuration. Refer to the Microsoft Security Update CVE-2026-78520 advisory for parser-specific details.

Detection Methods for CVE-2026-78520

Indicators of Compromise

Office application processes (WINWORD.EXE, OUTLOOK.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, mshta.exe, or rundll32.exe.
Office processes writing executable content to user-writable directories like %APPDATA%, %LOCALAPPDATA%\Temp, or Downloads.
Outbound network connections initiated directly by Office processes to newly registered or uncategorized domains shortly after document open events.

Detection Strategies

Hunt for anomalous parent-child process relationships originating from Office binaries using EDR telemetry.
Correlate email gateway logs with endpoint document-open events to identify recipients of attachments matching known malicious hashes.
Enable and monitor Microsoft Defender Attack Surface Reduction (ASR) audit events for rules that block Office child process creation.

Monitoring Recommendations

Ingest Office telemetry, Sysmon process and network events, and email gateway logs into a centralized analytics platform for correlation.
Alert on Office processes loading unusual DLLs or accessing LSASS, credential stores, or scheduled task interfaces.
Track patch deployment coverage for Microsoft 365 Apps, Office 2019, 2021, and 2024 across the fleet to identify unpatched endpoints.

How to Mitigate CVE-2026-78520

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-78520 to all affected Office installations.
Prioritize systems that regularly process external documents, including executive assistants, finance, HR, and customer-facing teams.
Confirm Microsoft 365 Apps update channels are current and validate build numbers post-deployment.

Patch Information

Microsoft has released fixes through its regular update channels. Refer to the Microsoft Security Update CVE-2026-78520 page for build numbers, KB articles, and platform-specific download links covering Windows and macOS Office variants.

Workarounds

Enable Protected View and Office Application Guard for documents originating from the internet or email attachments.
Configure Microsoft Defender ASR rules to block Office applications from creating child processes and injecting into other processes.
Disable the Outlook and Explorer preview pane for Office file types until patches are applied to reduce exposure from automatic rendering.

bash

# Enable ASR rule: Block all Office applications from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Verify current Office build (Microsoft 365 Apps)
& "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user