CVE-2026-83891: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-83891 Overview

CVE-2026-83891 is a stack-based buffer overflow [CWE-20] in Microsoft Office Word that allows an unauthenticated attacker to execute arbitrary code over a network. Exploitation requires a user to open or preview a crafted Word document. Successful exploitation yields code execution in the context of the current user, enabling full compromise of the targeted account. Microsoft published guidance in the Microsoft Security Update Guide. The flaw affects multiple supported Office channels across Windows and macOS.

Critical Impact
A crafted Word document can trigger remote code execution on vulnerable Microsoft 365 Apps, Office 2021, and Office 2024 installations when opened by a victim.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office LTSC 2021 and Office LTSC 2024 (Windows x64/x86 and macOS)

Discovery Timeline

2026-10-13 - CVE-2026-83891 published to the National Vulnerability Database
2026-10-14 - Record last modified in NVD

Technical Details for CVE-2026-83891

Vulnerability Analysis

The issue is a stack-based buffer overflow in the Word document parsing path. Microsoft Word writes attacker-controlled data to a fixed-size stack buffer without validating the input length. The condition is classified under [CWE-20] Improper Input Validation. When a user opens a malicious .doc or .docx file, the overflow corrupts the stack frame, including the saved return address and local variables.

An attacker who controls the overflow can redirect execution to shellcode or chained return-oriented programming (ROP) gadgets. Code runs with the privileges of the logged-on user. If the user holds administrative rights, the attacker gains full control of the host. The EPSS score of 0.774% indicates measurable near-term exploitation probability relative to typical Office vulnerabilities.

Root Cause

The root cause is missing or incorrect bounds checking when Word processes a structured field inside a document. The parser trusts a length value supplied by the file instead of enforcing the destination buffer size, which permits a classic stack smash during deserialization of the document stream.

Attack Vector

Attacks are delivered over the network through standard document distribution channels: email attachments, SharePoint and OneDrive links, chat platforms, and web downloads. User interaction is required, typically opening the document or rendering it in the Preview Pane. No prior authentication to the target is needed. Attackers can weaponize the flaw as part of phishing campaigns targeting knowledge workers.

No public proof-of-concept exploit is listed in the enriched data, and the vulnerability is not currently on the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update Guide for parser-level technical detail.

Detection Methods for CVE-2026-83891

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Outbound network connections initiated by WINWORD.EXE to untrusted or newly registered domains shortly after a document is opened.
Word crash events in the Windows Application log referencing a faulting module tied to document parsing, followed by anomalous process activity.
Office documents arriving from external senders containing unusually large or malformed field structures.

Detection Strategies

Alert on process-lineage anomalies where Office applications spawn script interpreters or living-off-the-land binaries (LOLBins).
Deploy YARA rules on mail gateways to flag Word documents containing malformed or oversized record structures consistent with buffer overflow triggers.
Correlate Office crash telemetry with subsequent process creation and network egress to identify exploitation attempts that fail or succeed.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and injecting code.
Forward Sysmon Event ID 1 (process creation) and Event ID 3 (network connection) to a centralized analytics platform for Office binaries.
Monitor file-write telemetry for new executables, scheduled tasks, or Run-key entries created within minutes of a Word document opening.

How to Mitigate CVE-2026-83891

Immediate Actions Required

Apply the Microsoft security update for Word referenced in the Microsoft Security Update Guide across all affected channels.
Prioritize patching endpoints used by high-risk roles such as executives, finance, HR, and personnel who handle external documents.
Confirm that both Windows and macOS Office installations are updated, since the flaw affects both platforms.

Patch Information

Microsoft has released fixes for Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021, and Office LTSC 2024. Validate the installed build number against the fixed version listed in the Microsoft Security Update Guide. For managed fleets, push updates through Microsoft Intune, Configuration Manager, or the Click-to-Run update channel.

Workarounds

Disable the Preview Pane and Reading Pane in Outlook and Windows Explorer to prevent automatic rendering of untrusted Word documents.
Enforce Protected View and Office Protected Mode for files originating from the internet, email attachments, and unsafe locations.
Block or quarantine inbound Word documents from external senders at the mail gateway until patching is complete.
Apply ASR rules that prevent Office applications from creating child processes to limit post-exploitation activity.

bash

# Enable key Attack Surface Reduction rules via PowerShell
# Block Office apps from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

# Block Office apps from injecting code into other processes
Add-MpPreference -AttackSurfaceReductionRules_Ids `
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled