CVE-2026-80085: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-80085 Overview

CVE-2026-80085 is a heap-based buffer overflow [CWE-122] in Microsoft Office Word that permits remote code execution. An unauthorized attacker can execute arbitrary code by delivering a crafted document to a target user. Exploitation requires the victim to open the malicious file, which typically arrives through phishing or a compromised file share. Code runs in the security context of the user opening the document, enabling initial access, persistence, and lateral movement.

The flaw affects supported Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and Word 2016 across Windows and macOS builds. Microsoft published the advisory on September 8, 2026.

Critical Impact
A single crafted Word document opened by a user grants attackers arbitrary code execution with full read, write, and availability impact on the host.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86)
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Word 2016 (x64 and x86) and Microsoft 365 for macOS

Discovery Timeline

2026-09-08 - CVE-2026-80085 published to the National Vulnerability Database
2026-09-09 - NVD record last modified

Technical Details for CVE-2026-80085

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow inside the Word document parser. When Word processes a specially crafted file, it writes attacker-controlled data past the bounds of a heap allocation. The out-of-bounds write corrupts adjacent heap metadata or object pointers used later during rendering. An attacker who controls the corrupted structures can redirect execution flow and run arbitrary code inside the WINWORD.EXE process.

The network attack vector reflects delivery of the crafted document over email, web download, or file share. Exploitation requires the target user to open the file. Word's Protected View can hinder exploitation for documents flagged with Mark-of-the-Web, but users who click Enable Editing execute the parser on untrusted content. The macOS builds of Microsoft 365, Office 2021 LTSC, and Office 2024 LTSC are also in scope.

Root Cause

The root cause is missing or incorrect bounds validation in a Word file-format parsing routine. Malformed length fields or nested record structures cause the parser to allocate an undersized heap buffer and then copy more data than the buffer can hold, matching the [CWE-122] pattern. Microsoft has not published the specific parsing component in the public advisory.

Attack Vector

A typical attack chain begins with a phishing message carrying a .doc, .docx, or .rtf file, or a link to one hosted on an attacker-controlled server. When the victim opens the file outside Protected View, the vulnerable parser triggers the heap overflow. Successful exploitation yields code execution as the current user, enabling credential theft, ransomware staging, or beacon deployment. See the Microsoft Security Update Guide for vendor-provided technical detail.

Detection Methods for CVE-2026-80085

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, such as cmd.exe, powershell.exe, mshta.exe, rundll32.exe, or wscript.exe.
Word writing executables, scripts, or DLLs to %APPDATA%, %TEMP%, or user profile startup folders.
Outbound network connections from WINWORD.EXE to unfamiliar domains or IPs shortly after a document is opened.
Crash telemetry, Windows Error Reporting entries, or Watson dumps referencing WINWORD.EXE heap corruption faults.

Detection Strategies

Deploy behavioral endpoint detection rules that flag Office applications spawning shells, script hosts, or LOLBins.
Alert on Office processes performing suspicious in-memory allocations, RWX regions, or reflective loading patterns consistent with exploit shellcode.
Correlate email gateway telemetry on inbound Word attachments with subsequent process and network activity on the receiving endpoint.

Monitoring Recommendations

Ingest Sysmon Event IDs 1, 7, 11, and 3 for Office processes into your SIEM to build a baseline of normal Word behavior.
Monitor Microsoft Defender ASR rule telemetry, especially rules that block Office child-process creation and Office code injection.
Track document open events from unmanaged locations, such as personal webmail or removable media, that bypass corporate Mark-of-the-Web enforcement.

How to Mitigate CVE-2026-80085

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-80085 across all Windows and macOS Office installations as the primary remediation.
Enforce Protected View and Block macros from the internet through Group Policy for all Office channels.
Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and injecting into other processes.
Restrict inbound Office document types at the email gateway and detonate attachments in a sandbox before delivery.

Patch Information

Microsoft released fixes referenced in the Microsoft Security Update Guide for CVE-2026-80085. Administrators should deploy the update to Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, and Word 2016 on both Windows and macOS. Verify Click-to-Run channels and volume-license builds report the patched version after deployment.

Workarounds

Configure Office to open documents from the internet and other untrusted zones in Protected View, and disable the Trust Bar Enable Editing option where feasible.
Use File Block policy to prevent opening legacy binary Word formats such as .doc from untrusted locations until patches are deployed.
Deliver security awareness reminders instructing users not to click Enable Editing on unsolicited documents.

bash

# Example Group Policy registry keys to harden Word against document-based exploitation
# Force Protected View for files originating from the internet
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f

# Block legacy Word binary documents via File Block
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\FileBlock" /v Word2000Files /t REG_DWORD /d 2 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\FileBlock" /v OpenInProtectedView /t REG_DWORD /d 1 /f