CVE-2026-78522: Microsoft 365 Apps Information Disclosure

CVE-2026-78522 Overview

CVE-2026-78522 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office Word. An unauthorized attacker can exploit the flaw to disclose information over a network. Exploitation requires user interaction, typically opening a malicious document. The vulnerability affects multiple Office versions including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Word 2016.

Microsoft published the advisory on September 8, 2026 and updated it later the same day. No public exploit or proof-of-concept is available, and CISA has not listed the issue in the Known Exploited Vulnerabilities catalog.

Critical Impact
Successful exploitation leaks memory contents from the Word process, which can expose sensitive document data, credentials cached in memory, or address information useful for chaining further attacks.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2019, Office 2021 LTSC, Office 2024 LTSC (x86 and x64)
Microsoft Word 2016 (x86 and x64)

Discovery Timeline

2026-09-08 - CVE-2026-78522 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-78522

Vulnerability Analysis

The flaw is an out-of-bounds read within Microsoft Word's document parsing logic. When Word processes a crafted file, it reads memory past the end of an allocated buffer. The read returns process memory that was not intended to be exposed to the document content or scripting surface.

The attack is network-reachable because Word documents are commonly delivered through email, web downloads, and file shares. Exploitation requires the target user to open the malicious file. No privileges are needed on the target system, and the scope is unchanged.

The impact is limited to confidentiality. Integrity and availability are not affected, meaning the bug cannot alone modify data or crash the process reliably. Attackers typically use such reads to leak stack cookies, heap layout, or ASLR-relevant pointers to support a second-stage exploit.

Root Cause

The root cause is an out-of-bounds read [CWE-125] in the Word file parser. The parser trusts a size, offset, or index field embedded in the document without validating it against the actual buffer bounds. Microsoft has not published parser-level technical details in the advisory.

Attack Vector

An attacker crafts a malicious Word document and delivers it to a target through email, a link, or a shared location. When the user opens the document in a vulnerable Word version, the parser triggers the out-of-bounds read. The leaked bytes can be exfiltrated back to the attacker through embedded document features or paired with a follow-on vulnerability.

No verified proof-of-concept code is published for CVE-2026-78522. See the Microsoft Update Guide CVE-2026-78522 for vendor-supplied technical details.

Detection Methods for CVE-2026-78522

Indicators of Compromise

Unexpected WINWORD.EXE child processes such as cmd.exe, powershell.exe, or mshta.exe following the opening of an external document.
Word documents originating from external senders that carry the Mark-of-the-Web and are opened outside of Protected View.
Outbound network connections from WINWORD.EXE to uncommon destinations shortly after a document is opened.
Crashes or Windows Error Reporting entries referencing Word modules such as wwlib.dll when processing untrusted files.

Detection Strategies

Hunt for Office process telemetry that shows WINWORD.EXE spawning script interpreters or performing file writes to %TEMP% or %APPDATA%.
Correlate email gateway attachment metadata with endpoint document-open events to surface documents that trigger anomalous parser behavior.
Monitor for Office document parsing crashes and faulting modules that repeat across multiple hosts, which can indicate weaponized files in circulation.

Monitoring Recommendations

Enable and forward Microsoft Defender AntiVirus and AMSI telemetry for Office to a central SIEM for correlation.
Ingest Sysmon Event ID 1 (process create) and Event ID 3 (network connect) for WINWORD.EXE to identify post-open activity.
Track Office version and build inventory to confirm every endpoint receives the September 2026 security update.

How to Mitigate CVE-2026-78522

Immediate Actions Required

Apply the September 2026 security updates for Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Word 2016 as listed in the Microsoft advisory.
Enforce Protected View and Block Macros From The Internet for all Office clients to reduce exposure from internet-delivered documents.
Instruct users to avoid opening unsolicited Word attachments and to leave documents in Protected View until validated.

Patch Information

Microsoft addresses CVE-2026-78522 through the September 2026 Patch Tuesday release. Refer to the Microsoft Update Guide CVE-2026-78522 for the KB article, affected builds, and update channels applicable to each product edition.

Workarounds

Keep Office Protected View enabled for files originating from the internet, email attachments, and unsafe locations.
Use Microsoft Office File Block policy to prevent legacy Word binary formats from opening until patching completes.
Route inbound documents through a content disarm and reconstruction (CDR) or sandbox detonation pipeline at the email gateway.

bash

# Example: enforce Protected View for internet-sourced Office files via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f