CVE-2026-78521: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-78521 Overview

CVE-2026-78521 is a heap-based buffer overflow [CWE-122] in Microsoft Office Word that enables remote code execution. An unauthorized attacker can craft a malicious document that triggers memory corruption when opened by a targeted user. Successful exploitation grants the attacker code execution in the context of the current user account.

The vulnerability affects multiple supported Office releases on Windows and macOS, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Word 2016. Microsoft published the advisory on September 8, 2026.

Critical Impact
Attackers can execute arbitrary code on a victim workstation with a single crafted Word document, enabling initial access, credential theft, and lateral movement across enterprise environments.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Word 2016 (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-78521 published to the National Vulnerability Database (NVD)
2026-09-08 - Microsoft published security update guide entry
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78521

Vulnerability Analysis

The flaw is a heap-based buffer overflow within Microsoft Office Word's document parsing logic. When Word processes a specially crafted file, it writes data past the bounds of an allocated heap buffer, corrupting adjacent memory structures.

Exploitation requires user interaction. A victim must open the malicious document, which can be delivered through email attachments, cloud file shares, or drive-by download. The Preview Pane can also serve as an attack surface in similar Office parsing flaws.

Successful exploitation yields code execution in the security context of the user running Word. On workstations where users operate with administrative rights, the attacker gains full control of the host.

Root Cause

The root cause is improper validation of size or length fields during heap allocation and subsequent memory copy operations in Word's document parser. Attacker-controlled values in the document structure cause the parser to write beyond the allocated buffer, overwriting adjacent heap metadata or object pointers. Attackers use this primitive to redirect execution flow, typically by corrupting function pointers or virtual method tables.

Attack Vector

The attack vector is network-based, with delivery through email, SharePoint, OneDrive, or web downloads. The attacker crafts a Word document (.doc, .docx, .rtf, or related format) containing malformed structures that trigger the overflow when parsed. No prior authentication to the target system is required, but user interaction to open the file is necessary.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog as of the advisory date. Refer to the Microsoft Security Update Guide for parser-level technical detail.

Detection Methods for CVE-2026-78521

Indicators of Compromise

Unexpected child processes spawned by winword.exe or WINWORD.EXE, particularly cmd.exe, powershell.exe, mshta.exe, rundll32.exe, or regsvr32.exe
Word crashes with heap corruption exceptions (0xC0000374, STATUS_HEAP_CORRUPTION) shortly after opening a document from email or the internet
Outbound network connections initiated by winword.exe to previously unseen domains or IP addresses
Creation of persistence artifacts (Run keys, scheduled tasks, startup folder files) following document open events

Detection Strategies

Hunt for Office applications writing executable content to disk (.exe, .dll, .js, .hta, .lnk) or to %TEMP%, %APPDATA%, and %PUBLIC% paths
Correlate Mark-of-the-Web (MOTW) attributes on inbound documents with subsequent process launches from Word
Alert on Word loading unusual modules or DLLs from user-writable directories
Apply MITRE ATT&CK mappings for T1566.001 (Spearphishing Attachment) and T1204.002 (User Execution: Malicious File)

Monitoring Recommendations

Enable Sysmon Event IDs 1 (process creation), 3 (network connection), and 11 (file create) with Office parent-process filtering
Forward Windows Defender Exploit Guard and Attack Surface Reduction (ASR) rule telemetry to your SIEM
Monitor mail gateway logs for documents with suspicious embedded objects, macros, or oversized structural fields
Track user-reported Word crashes as potential exploitation attempts and preserve crash dumps for analysis

How to Mitigate CVE-2026-78521

Immediate Actions Required

Apply the September 2026 Microsoft security updates to all affected Office installations without delay
Prioritize patching for users who routinely open documents from external senders, including finance, HR, and executive staff
Verify Microsoft 365 Apps client channels are receiving updates and confirm build numbers post-deployment
Block or quarantine inbound .doc, .docx, and .rtf attachments from untrusted senders at the mail gateway pending patch rollout

Patch Information

Microsoft released fixed builds via the Microsoft Security Update Guide. Administrators should consult the Microsoft Security Update for CVE-2026-78521 for specific KB article numbers, update channels, and version thresholds for each affected product. Microsoft 365 Apps updates deploy through Click-to-Run; MSI-based installs (Office 2019, 2021 LTSC, 2024 LTSC, Word 2016) require the corresponding KB packages via Windows Update, WSUS, or Microsoft Update Catalog.

Workarounds

Enable Protected View for files originating from the internet, Outlook attachments, and unsafe locations
Configure ASR rule Block Office applications from creating child processes (GUID D4F940AB-401B-4EFC-AADC-AD5F3C50688A) in Block mode
Disable the Outlook Preview Pane and Reading Pane for high-risk mailboxes until patches are applied
Enforce File Block policies through Group Policy to prevent legacy Word formats from opening outside Protected View

bash

# Enable ASR rule to block Office child processes (PowerShell, run as Administrator)
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

# Verify Protected View settings for Word (per-user registry)
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV   /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f