Microsoft Word: Heap-based buffer overflow enables remote code execution
Summary
A heap-based buffer overflow in Microsoft Word, part of Microsoft 365 Apps and Office LTSC releases, can be exploited by an unauthenticated remote attacker. The CVSS vector requires user interaction, so an attacker would need to get a victim to open a crafted Word document, typically sent by email or downloaded. Successful exploitation could allow arbitrary code execution with the privileges of the user. No public proof of concept or evidence of active exploitation was found.
Affected
- Microsoft 365 Apps for Enterprise (16.0.1 to below the fixed build listed on the Microsoft release page)
- Microsoft Office 365 for Mac (1.0.0 to below 16.114.26101123)
- Microsoft Office LTSC 2021 (16.0.1 to below 16.0.14334.20974)
- Microsoft Office LTSC 2024 (16.0.0 to below 16.0.17932.21056, unverified)
- Microsoft Office LTSC for Mac 2021 and 2024 (below 16.114.26101123)
Fixed in
- Microsoft 365 Apps for Enterprise: Unknown (build number not confirmed; see Microsoft release page)
- Office 365 for Mac and Office LTSC for Mac 2021/2024: 16.114.26101123 or later
- Office LTSC 2021: 16.0.14334.20974 or later
- Office LTSC 2024: 16.0.17932.21056 or later (unverified, to be confirmed on MSRC)
Workaround
Unknown. No vendor workaround found. Microsoft's stated action is to apply the security update.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- Not listed in CISA KEV at the time of research
- EPSS below 1%
- No public proof of concept found
- Not confirmed as linked to the actively exploited zero-day reported in the October 2026 Microsoft release
Our recommendation
- Patch Microsoft 365 Apps, Office LTSC and Office for Mac clients via the normal update channels, verifying the build numbers for each product on the MSRC advisory
- Prioritise mail-facing and document-heavy systems
- Keep Protected View enabled for files from the internet and email
- Restrict risky attachment types at the mail gateway and train users not to open unexpected Word documents
- Check KEV and MSRC again, as the record is new
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-108430 msrc.microsoft.com
- OpenCVE: CVE-2026-108430 app.opencve.io
- Strix: CVE-2026-108430 affected builds www.strix.ai
- OffSeq Radar: CVE-2026-108430 radar.offseq.com
- VulDB: CVE-2026-108430 vuldb.com
- QuestReview Center: October 2026 Office flaws questreviewcenter.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:25.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.