CVE-2026-78526: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-78526 Overview

CVE-2026-78526 is a heap-based buffer overflow [CWE-122] in Microsoft Office Word that allows an unauthorized attacker to execute arbitrary code over a network. The flaw affects multiple supported Office releases across Windows and macOS platforms, including Microsoft 365 Apps and standalone Office LTSC editions. Exploitation requires user interaction, typically opening or previewing a crafted document, but does not require prior authentication. Successful exploitation gives the attacker code execution in the context of the current user, enabling follow-on actions such as credential theft, lateral movement, or malware deployment.

Critical Impact
A single crafted Word document delivered through email, chat, or a web download can trigger remote code execution in the user's security context across all supported Microsoft Office desktop versions.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (including macOS builds where applicable)

Discovery Timeline

2026-09-08 - CVE-2026-78526 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-78526

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow inside Microsoft Word's document parsing logic. When Word processes a specifically crafted file, it writes data past the bounds of a heap-allocated buffer. The overflow corrupts adjacent heap metadata or object pointers, which an attacker can shape to hijack control flow. Because Word is a client application invoked by user actions such as opening attachments, the attack surface extends to any workflow that renders Office documents, including the Outlook Preview Pane in configurations that render Word content.

The issue is tracked under CWE-122: Heap-based Buffer Overflow. Exploitation yields code execution with the privileges of the user running Word. On systems where users hold local administrator rights, the impact expands to full host compromise. The EPSS estimate at publication is 0.594% (percentile 46.466), indicating limited but non-zero near-term exploitation probability.

Root Cause

The root cause is insufficient validation of size or length fields during parsing of an embedded structure in a Word document. Word allocates a heap buffer using an attacker-influenced length and later copies attacker-controlled bytes into that buffer without a corresponding bounds check, producing the out-of-bounds write.

Attack Vector

The attack vector is network-based with required user interaction. An attacker delivers a malicious .doc, .docx, .rtf, or related Office file through phishing email, a collaboration platform, or a web download. When the victim opens or previews the file in a vulnerable version of Word, the overflow is triggered and shellcode staged by the attacker executes in the Word process.

No verified proof-of-concept code is publicly available at the time of writing. See the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-78526

Indicators of Compromise

Word (WINWORD.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Word process crashes with heap corruption exceptions (c0000374, c0000005) shortly after opening an external document.
Outbound network connections from WINWORD.EXE to previously unseen domains or IP addresses immediately after document open.
Creation of executable files, scheduled tasks, or startup entries by the Word process or its children.

Detection Strategies

Hunt for Office applications launching LOLBins or scripting hosts, mapped to MITRE ATT&CK T1566.001 (Spearphishing Attachment) and T1204.002 (Malicious File).
Inspect inbound Office attachments at the mail gateway using static and dynamic analysis to flag malformed structures that trigger parser anomalies.
Correlate Word process crashes with subsequent process creation or persistence events to identify failed or partial exploitation attempts.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and executable content.
Forward Sysmon Event IDs 1 (process create), 3 (network connect), and 11 (file create) from endpoints running Office to a centralized SIEM for correlation.
Alert on any process ancestry where WINWORD.EXE is the parent of an interpreter, script host, or unsigned binary.

How to Mitigate CVE-2026-78526

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Office installations, including macOS builds.
Inventory endpoints for Microsoft 365 Apps, Office 2016, 2019, 2021 LTSC, and 2024 LTSC, and prioritize patching for users who routinely open external documents.
Enforce Protected View and Office File Block policies for documents originating from the internet or email attachments.
Disable the Outlook Preview Pane for high-risk mailboxes until patches are deployed.

Patch Information

Microsoft has released updates addressing CVE-2026-78526 through its monthly security update channel. Administrators should deploy the corresponding updates for each Office family through Microsoft Update, WSUS, Intune, Configuration Manager, or Microsoft AutoUpdate for macOS. Confirm remediation by verifying the patched build number in File > Account > About Word.

Workarounds

Configure Group Policy to open documents from the internet zone in Protected View and block macros in files from the internet.
Use Attack Surface Reduction rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A to prevent Office applications from creating child processes.
Route inbound Office attachments through a sandbox or content disarm and reconstruction (CDR) solution until patches are applied.

bash

# Enable ASR rule to block Office child process creation (Windows PowerShell)
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Enforce Protected View for files originating from the internet (registry example, Word 2016+)
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f