CVE-2026-78524: Microsoft 365 Apps RCE Vulnerability

CVE-2026-78524 Overview

CVE-2026-78524 is an out-of-bounds write vulnerability [CWE-787] in Microsoft Office that enables remote code execution. An unauthorized attacker can trigger the flaw over a network by convincing a user to open a crafted document. Successful exploitation runs attacker-controlled code in the context of the current user, leading to full compromise of confidentiality, integrity, and availability on the target host. The vulnerability affects Microsoft 365 Apps, Microsoft 365 for macOS, and Office 2016, 2019, 2021, and 2024 across x86, x64, and macOS builds.

Critical Impact

Remote code execution across all supported Microsoft Office versions on Windows and macOS following a single user interaction with a malicious document.

Affected Products

• Microsoft 365 Apps (Enterprise, x86 and x64)
• Microsoft 365 for macOS
• Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows and macOS variants)

Discovery Timeline

• 2026-09-08 - CVE-2026-78524 published to the National Vulnerability Database
• 2026-09-09 - Last updated in NVD database
• 2026-09-10 - EPSS score published at 0.819% (55th percentile)

Technical Details for CVE-2026-78524

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] within Microsoft Office document parsing routines. When Office processes a specially crafted file, the code writes data past the boundaries of an allocated buffer. This corrupts adjacent memory structures such as heap metadata, function pointers, or object vtables. An attacker who controls the overwritten data can redirect execution flow and run arbitrary code in the user's security context.

Because the flaw resides in shared document-processing code, it reaches Windows and macOS builds of Office. The user interaction requirement is minimal: opening the document, or in some cases previewing it, is sufficient to trigger the parsing path.

Root Cause

Out-of-bounds writes typically stem from missing or incorrect bounds checks during the parsing of structured document formats. A malformed size field, length prefix, or object index causes the parser to compute a destination offset that exceeds the target buffer. Microsoft has not published low-level technical details, but the CWE-787 classification confirms the write-past-boundary primitive.

Attack Vector

Exploitation occurs over a network by delivering a weaponized Office document through email, file-sharing services, or a web download. The victim opens the document in an affected Office version, and parsing of the malicious content triggers the memory corruption. Attackers commonly chain this class of flaw with sandbox escapes or protected-view bypasses to achieve reliable code execution outside the Office container.

No public proof-of-concept or exploit code is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update Guide for vendor-provided technical context.

Detection Methods for CVE-2026-78524

Indicators of Compromise

• Unexpected child processes spawned by winword.exe, excel.exe, or powerpnt.exe, such as cmd.exe, powershell.exe, mshta.exe, or rundll32.exe.
• Office application crashes with access violations shortly after opening a document from an external source.
• Outbound network connections initiated by Office processes to previously unseen domains or IP addresses.
• New persistence artifacts (scheduled tasks, Run keys, LaunchAgents on macOS) created within minutes of document open events.

Detection Strategies

• Hunt for Office processes writing executable content to %TEMP%, %APPDATA%, or ~/Library/ paths.
• Monitor for anomalous DLL loads and injected threads within Office processes using EDR telemetry.
• Correlate document open events with subsequent process, file, and network activity to surface exploitation chains.

Monitoring Recommendations

• Ingest Office telemetry, Sysmon (or equivalent), and email gateway logs into a centralized analytics pipeline.
• Alert on inbound Office documents with embedded objects, unusual OLE streams, or macros from untrusted senders.
• Track patch state of Office installations across the fleet to identify unpatched hosts opening external documents.

How to Mitigate CVE-2026-78524

Immediate Actions Required

• Apply the Microsoft security update for CVE-2026-78524 to all affected Office and Microsoft 365 Apps installations without delay.
• Prioritize patching for users who routinely receive external documents, including finance, HR, legal, and executive staff.
• Enable Protected View and Office Application Guard where available to contain untrusted document parsing.

Patch Information

Microsoft has released fixes through the standard Office and Microsoft 365 update channels. Consult the Microsoft Security Update Guide for CVE-2026-78524 for specific build numbers per product and platform, including the macOS variants of Microsoft 365 and Office 2021/2024 LTSC.

Workarounds

• Block or quarantine Office documents received from external senders at the email gateway pending patch deployment.
• Disable ActiveX controls, DDE, and legacy file format handlers via Group Policy or Office Trust Center settings.
• Enforce Attack Surface Reduction (ASR) rules that prevent Office applications from creating child processes and injecting into other processes.
• Restrict opening of documents from the internet zone using Windows Mark-of-the-Web enforcement.

# Example ASR rule enablement via PowerShell (Windows)
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

# Block Office child process creation to reduce exploitation impact