CVE-2026-96995: Microsoft Word Privilege Escalation Flaw

CVE-2026-96995 Overview

CVE-2026-96995 is a stack-based buffer overflow vulnerability [CWE-121] in Microsoft Office Word. An authorized local attacker can exploit the flaw to elevate privileges on an affected system. The weakness resides in Word's parsing logic, where malformed input overruns a fixed-size stack buffer and corrupts adjacent control data, including saved return addresses. Successful exploitation yields high impact to confidentiality, integrity, and availability within the context of the targeted process.

Critical Impact
A local, authorized attacker can trigger a stack-based buffer overflow in Microsoft Office Word to escalate privileges and gain high-impact control over confidentiality, integrity, and availability.

Affected Products

Microsoft Office Word (specific versions listed in the Microsoft Security Update Guide)

Discovery Timeline

2026-10-13 - CVE-2026-96995 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in the NVD database

Technical Details for CVE-2026-96995

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow in Microsoft Office Word. Word processes a crafted document and copies attacker-controlled data into a stack buffer without enforcing the destination size. The overflow overwrites adjacent stack memory, including saved return addresses, structured exception handler records, and local variables. An attacker who already holds low-privilege, local access can leverage this corruption to redirect execution and run code with elevated privileges in the Word process context.

The attack requires no user interaction once the attacker initiates the exploitation path on the local system. Exploitation does require low-level privileges on the host, which aligns with scenarios where an attacker has already achieved initial access and is pursuing privilege escalation as a second-stage objective.

Root Cause

The root cause is unsafe handling of input length within a Word parsing routine that writes to a fixed-size stack buffer [CWE-121]. The function does not validate or truncate incoming data against the destination buffer size, allowing adjacent stack frames to be overwritten. Microsoft has not published implementation-level detail; the authoritative description is available in the Microsoft Security Update Guide.

Attack Vector

The attack vector is local. An authorized attacker delivers a crafted Office document and causes Word to parse it under conditions that trigger the overflow. Because the privileges-required value is low and no user interaction is needed on the exploitation step, this flaw is well suited for use in a post-compromise privilege escalation chain alongside initial-access techniques such as phishing or malicious document delivery.

No public proof-of-concept exploit is currently referenced in the vulnerability record, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-96995

Indicators of Compromise

Unexpected WINWORD.EXE crashes with exception codes consistent with stack corruption, such as 0xC0000409 (stack buffer overrun) or 0xC0000005 (access violation).
Office documents staged in user-writable paths that were opened immediately before anomalous child processes spawned from WINWORD.EXE.
WINWORD.EXE spawning command interpreters such as cmd.exe, powershell.exe, or rundll32.exe shortly after document open.

Detection Strategies

Hunt for process-lineage anomalies where WINWORD.EXE is the parent of scripting hosts, LOLBins, or binaries writing to %TEMP% and %APPDATA%.
Correlate Windows Error Reporting events referencing WINWORK.EXE or wwlib.dll with subsequent token-manipulation or privilege-change events.
Baseline normal document-open activity per user and alert on bursts of malformed .doc, .docx, or .rtf files from a single source.

Monitoring Recommendations

Ingest Microsoft Office telemetry, Sysmon process-creation events, and Windows crash logs into a centralized analytics pipeline for correlation.
Monitor local privilege-escalation primitives following Word execution, including new service creation, scheduled task registration, and access-token changes.
Track endpoints that remain unpatched against Microsoft's October 2026 Office updates and prioritize them for elevated monitoring.

How to Mitigate CVE-2026-96995

Immediate Actions Required

Apply the Microsoft Office security update referenced in the Microsoft Security Update Guide to all affected Word installations.
Prioritize patching on multi-user systems, jump hosts, and workstations where lower-privileged users execute Office content.
Audit local accounts for unnecessary interactive logon rights to reduce the pool of users who meet the authorized-local precondition.

Patch Information

Microsoft addresses CVE-2026-96995 through its monthly security update channel. Refer to the Microsoft Security Update Guide for the authoritative list of fixed builds, Click-to-Run channels, and Microsoft Update Catalog download links. Deploy updates through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or an equivalent patch-management platform.

Workarounds

Enable Protected View and Office Protected Process defenses to constrain parsing of documents originating from the internet or email.
Block or quarantine inbound Office documents from untrusted senders at the mail gateway until patching is complete.
Enforce Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting into other processes.

bash

# Enable key Microsoft Defender ASR rules via PowerShell
Add-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

Add-MpPreference -AttackSurfaceReductionRules_Ids `
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled