Office Word: Heap-based buffer overflow enables remote code execution
Summary
A heap-based buffer overflow in Microsoft Word, part of Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, allows remote code execution. An attacker can run code on the victim's computer if a user opens a manipulated document, for example one received by email or downloaded from the internet. No login is required, but user interaction is needed. The CVSS 3.1 base score is 8.8. No exploitation is known at the time of writing.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build (exact build unknown, see MSRC)
- Microsoft Office LTSC 2021: 16.0.1 to before 16.0.14334.20974
- Microsoft Office LTSC 2024: 16.0.0 to before 16.0.17932.21056
- Office 2016/2019 and Click-to-Run status: Unknown.
Fixed in
- Microsoft Office LTSC 2021: 16.0.14334.20974 or later
- Microsoft Office LTSC 2024: 16.0.17932.21056 or later
- Microsoft 365 Apps for Enterprise: Unknown. Check the Microsoft release notes at https://aka.ms/OfficeSecurityReleases and the MSRC advisory.
Workaround
Unknown. No vendor-published workaround has been found for this CVE.
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact.
- Not listed in the CISA KEV catalogue.
- No public proof-of-concept found in the research. This does not prove that none exists.
- EPSS score: Unknown in one tracker.
Our recommendation
- Confirm the fixed builds on the MSRC advisory before rollout.
- Install the Microsoft security update for CVE-2026-108426 on all affected Microsoft 365 Apps and Office LTSC installations with high priority.
- Check the update channel status and whether updates require a restart.
- Keep Protected View enabled for files from the internet and email attachments.
- Monitor for suspicious Office document activity and verify the patch level afterwards.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-108426 msrc.microsoft.com
- OpenCVE: CVE-2026-108426 app.opencve.io
- VulDB: CVE-2026-108426 vuldb.com
- Threat Intelligence mirror: CVE-2026-108426 cve.threatint.com
- Strix: CVE-2026-108426 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:27.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.