CVE-2026-81952: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-81952 Overview

CVE-2026-81952 is a heap-based buffer overflow [CWE-122] in Microsoft Office Word that enables remote code execution over a network. An unauthorized attacker can craft a malicious document that, when opened by a user, triggers memory corruption in the Word process. Successful exploitation grants the attacker the ability to execute arbitrary code in the context of the current user. The flaw affects Microsoft 365 Apps, Microsoft 365 for macOS, Office 2016, Office 2019, Office 2021, and Office 2024 across x86, x64, and macOS builds. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

Critical Impact
Attackers can achieve remote code execution by delivering a crafted Word document, compromising confidentiality, integrity, and availability of the target host.

Affected Products

Microsoft 365 Apps (Enterprise x86 and x64)
Microsoft 365 for macOS, Microsoft Office 2016, and Microsoft Office 2019
Microsoft Office LTSC 2021 and Microsoft Office LTSC 2024 (Windows and macOS)

Discovery Timeline

2026-09-08 - CVE-2026-81952 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-81952

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Microsoft Office Word's document parsing logic. When Word processes a malformed structure inside a crafted document, it writes beyond the bounds of a heap allocation. The corrupted heap metadata or adjacent object state can then be leveraged to redirect control flow and execute attacker-supplied code. Exploitation requires user interaction, meaning the victim must open the malicious document, but no prior authentication to the target system is needed. Because Word is often the default handler for .doc, .docx, and .rtf files, phishing emails and drive-by downloads are viable delivery channels.

Root Cause

The root cause is improper validation of size or length fields during heap allocation and copy operations in Word's file format parser. When attacker-controlled input dictates a copy larger than the destination heap buffer, adjacent heap chunks are corrupted. This class of flaw, tracked as [CWE-122], commonly leads to arbitrary write primitives and eventual code execution.

Attack Vector

Delivery is network-based through email attachments, messaging platforms, cloud file shares, or web downloads. The attacker crafts a document containing malformed records or embedded objects that trigger the overflow when parsed. Preview panes and automatic file rendering in mail clients can increase exposure. Once code execution is achieved, the payload runs with the privileges of the logged-in user, enabling credential theft, lateral movement, or malware staging.

No public proof-of-concept code has been released. Consult the Microsoft Vulnerability Update CVE-2026-81952 for authoritative technical details.

Detection Methods for CVE-2026-81952

Indicators of Compromise

winword.exe spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Word processes making outbound network connections to previously unseen domains or IP addresses shortly after a document is opened.
Creation of executable files, scripts, or scheduled tasks in user-writable paths (%APPDATA%, %TEMP%, %LOCALAPPDATA%) immediately following document open events.
Crash dumps or Windows Error Reporting entries referencing winword.exe with heap corruption exceptions such as 0xC0000374.

Detection Strategies

Hunt for anomalous parent-child process relationships originating from winword.exe, especially involving script interpreters or LOLBins.
Inspect inbound email attachments and cloud-shared documents for malformed Office file structures using sandbox detonation.
Correlate document open telemetry with subsequent network beacons and file writes to detect post-exploitation activity.

Monitoring Recommendations

Enable and forward Microsoft Office telemetry, Sysmon process creation (Event ID 1), and network connection events (Event ID 3) to a centralized analytics platform.
Monitor endpoints for repeated Word crashes, which may indicate exploitation attempts or failed exploit development.
Track execution of macros, ActiveX controls, and embedded objects invoked from documents originating outside the organization.

How to Mitigate CVE-2026-81952

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Response Center advisory across all Windows and macOS Office installations.
Prioritize patching for users who routinely receive external documents, including executives, finance, HR, and legal teams.
Block or quarantine inbound Office documents from untrusted senders at the email gateway pending patch deployment.

Patch Information

Microsoft has released updates addressing CVE-2026-81952 for Microsoft 365 Apps, Microsoft 365 for macOS, Office 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024. Refer to the Microsoft Vulnerability Update CVE-2026-81952 page for the specific build numbers and deployment guidance for each channel.

Workarounds

Enable Protected View and Office Application Guard so untrusted documents open in an isolated container.
Configure Attack Surface Reduction rules to block Office applications from creating child processes and from injecting code into other processes.
Disable the Outlook Reading Pane for users who cannot be patched immediately to prevent automatic rendering of malicious attachments.
Enforce Mark-of-the-Web propagation so documents from the internet remain in Protected View until explicitly trusted.

bash

# Configuration example: PowerShell to enable key Office ASR rules
Set-MpPreference -AttackSurfaceReductionRules_Ids `
    D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
    -AttackSurfaceReductionRules_Actions Enabled

# Block Office apps from creating child processes (Word, Excel, PowerPoint)
Set-MpPreference -AttackSurfaceReductionRules_Ids `
    3B576869-A4EC-4529-8536-B80A7769E899 `
    -AttackSurfaceReductionRules_Actions Enabled