CVE-2026-80087 Overview
CVE-2026-80087 is a heap-based buffer overflow vulnerability [CWE-122] in Microsoft Office that permits an unauthorized attacker to disclose sensitive information over a network. The flaw affects multiple supported Office releases, including Microsoft 365 Apps, Microsoft 365 for macOS, and Office 2016, 2019, 2021, and 2024 across x86, x64, and macOS builds. Exploitation requires user interaction, typically the opening of a crafted document. Microsoft has published guidance in its Security Update Guide.
Critical Impact
Successful exploitation can expose confidential memory contents from an Office process to a remote attacker after a user opens a malicious document.
Affected Products
- Microsoft 365 Apps (Enterprise, x86 and x64) and Microsoft 365 for macOS
- Microsoft Office 2016 and Office 2019 (x86 and x64)
- Microsoft Office LTSC 2021 and Office LTSC 2024 (x86, x64, and macOS)
Discovery Timeline
- 2026-09-08 - CVE-2026-80087 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-80087
Vulnerability Analysis
The vulnerability is a heap-based buffer overflow within Microsoft Office document parsing routines. When Office processes a crafted file, it writes or reads past an allocated heap buffer, corrupting adjacent memory or exposing residual heap contents. Microsoft classifies the impact as information disclosure, with confidentiality affected but integrity and availability unchanged. The Exploit Prediction Scoring System places this issue in the middle range of observed exploitation likelihood, and no public proof-of-concept or in-the-wild exploitation has been reported at time of publication.
Root Cause
The underlying weakness maps to CWE-122: Heap-based Buffer Overflow. Improper bounds checking during the parsing of a structured Office document causes the process to access memory beyond an allocated heap object. Because the resulting access reads uninitialized or adjacent heap data, an attacker can craft a document that returns portions of process memory back to attacker-controlled fields.
Attack Vector
The attack is delivered over a network, most commonly through email attachments, cloud file shares, or hyperlinks that deliver a malicious Office file. Exploitation requires the target user to open the document in a vulnerable Office build. No privileges are required on the target system. Because the impact is limited to information disclosure, an attacker would typically use the leaked data to defeat address space layout randomization or extract sensitive document content prior to chaining another vulnerability.
No verified public exploit code is available for CVE-2026-80087. Refer to the Microsoft Security Update Guide entry for CVE-2026-80087 for technical details.
Detection Methods for CVE-2026-80087
Indicators of Compromise
- Office documents delivered from untrusted senders that trigger unexpected child processes or outbound network connections from winword.exe, excel.exe, or powerpnt.exe.
- Anomalous crash or Watson error events referencing Office binaries when opening specific documents.
- Outbound HTTP or SMB traffic initiated by Office processes shortly after a document is opened.
Detection Strategies
- Hunt for Office processes performing network egress to newly observed or low-reputation domains immediately after document open events.
- Correlate Microsoft Defender SmartScreen, mail gateway, and endpoint telemetry to identify recipients of the same weaponized document across the environment.
- Inspect Office documents at the mail gateway for malformed structures that trigger parser errors consistent with heap overflow conditions.
Monitoring Recommendations
- Enable and forward Office telemetry, Sysmon process creation, and network events to a centralized analytics platform for retrospective hunting.
- Monitor for Protected View bypass attempts and macro enablement on documents originating from external sources.
- Track patch compliance for Microsoft 365 Apps and standalone Office installations across Windows and macOS endpoints.
How to Mitigate CVE-2026-80087
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-80087 to all affected Office builds.
- Prioritize systems that regularly process externally sourced Office documents, such as finance, HR, and executive endpoints.
- Confirm that Microsoft 365 Apps update channels are not paused and that macOS Office clients are current.
Patch Information
Microsoft has released updates through the Security Update Guide covering Microsoft 365 Apps, Microsoft 365 for macOS, Office 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024. Deploy the applicable channel-specific update for each product family. Validate installation by checking the Office build number under File > Account > About on Windows or the Office menu on macOS.
Workarounds
- Keep Protected View and Office File Block policies enabled to open documents from the internet in a restricted sandbox.
- Disable preview handlers in Outlook and Windows Explorer for Office file types until patches are deployed.
- Enforce mail gateway rules that strip or quarantine Office attachments from untrusted external senders.
# Configuration example: enforce Protected View for files originating from the internet
# Windows registry key applied per Office version (example shown for Word 2016+)
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
