CVE-2026-78525 Overview
CVE-2026-78525 is a use-after-free vulnerability [CWE-416] affecting multiple Microsoft Office products, including Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021, Office 2024, and Word 2016. An unauthorized attacker can execute arbitrary code over a network by leveraging improper memory management within the affected Office components. Successful exploitation requires user interaction, such as opening a specially crafted document. Microsoft published the advisory on September 8, 2026, and the flaw carries network-based attack characteristics with high impact on confidentiality, integrity, and availability.
Critical Impact
Remote code execution in the context of the current user, enabling attacker-controlled payloads to run inside trusted Office processes across Windows and macOS installations.
Affected Products
- Microsoft 365 Apps (Enterprise x64 and x86)
- Microsoft 365 for macOS, Microsoft Office 2019, Office 2021 (LTSC), Office 2024 (LTSC)
- Microsoft Word 2016 (x64 and x86)
Discovery Timeline
- 2026-09-08 - CVE-2026-78525 published to NVD with Microsoft advisory
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-78525
Vulnerability Analysis
The flaw is a use-after-free condition [CWE-416] within Microsoft Office components shared across Outlook, Word, and the broader Office suite. When Office parses a crafted document or message, an object is freed while a reference to it remains reachable. Subsequent operations dereference the stale pointer, allowing an attacker who controls adjacent heap contents to hijack execution flow.
Exploitation runs code in the security context of the user opening the file. On systems where Office users hold administrative privileges, the attacker gains full control of the host. The vulnerability affects Office builds on both Windows and macOS, expanding the exposure surface for enterprise deployments.
Root Cause
The root cause is improper object lifetime management within an Office parsing routine. A structure is released before all references are cleared, leaving a dangling pointer. Crafted document content triggers reuse of the freed memory region under attacker influence, resulting in controlled memory corruption.
Attack Vector
Delivery occurs over a network, typically through phishing email attachments, malicious documents hosted on file shares, or drive-by delivery via web downloads. The user must open the malicious document or preview it in a vulnerable Office component. No prior authentication is required. Microsoft has not confirmed exploitation in the wild, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Refer to the Microsoft CVE-2026-78525 Advisory for vendor technical details. No verified public proof-of-concept is available at this time.
Detection Methods for CVE-2026-78525
Indicators of Compromise
- Office processes (winword.exe, outlook.exe) spawning command interpreters such as cmd.exe, powershell.exe, or wscript.exe.
- Unexpected child processes writing executables or scripts to %APPDATA%, %TEMP%, or user profile directories.
- Outbound network connections initiated directly by Office processes to previously unseen domains or IP addresses.
Detection Strategies
- Hunt for Office applications loading unusual DLLs or triggering ROP-style memory allocations consistent with use-after-free exploitation.
- Correlate email delivery telemetry with Office document open events to identify weaponized attachments.
- Apply behavioral rules that flag process injection or credential access originating from Office parent processes.
Monitoring Recommendations
- Enable and forward Microsoft Defender ASR rule telemetry, particularly the rule blocking Office child process creation.
- Ingest Office and endpoint process telemetry into a centralized data lake for cross-host correlation.
- Monitor patch compliance for Microsoft 365 Apps, Office 2019, 2021, and 2024 across Windows and macOS fleets.
How to Mitigate CVE-2026-78525
Immediate Actions Required
- Apply the Microsoft security updates referenced in the Microsoft CVE-2026-78525 Advisory across all Windows and macOS Office installations.
- Prioritize patching for internet-facing users, executives, and high-value mailboxes most likely to receive phishing attachments.
- Verify Click-to-Run update channels are healthy and force-refresh clients that report stale build numbers.
Patch Information
Microsoft has released fixed builds for Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Word 2016. Consult the vendor advisory for the exact build numbers per channel and platform. Distribute updates through Microsoft Update, WSUS, Intune, or the macOS AutoUpdate service.
Workarounds
- Enable Protected View and Office Application Guard for documents originating from the internet or email.
- Configure Microsoft Defender Attack Surface Reduction rules to block Office applications from creating child processes and injecting into other processes.
- Block or quarantine inbound email attachments containing legacy Office formats where business use does not require them.
# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
# Verify Office Click-to-Run channel and version
"C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe" /update user
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
