Microsoft Office Word: Remote code execution through heap-based buffer overflow
Summary
A heap-based buffer overflow in Microsoft Word, part of Microsoft 365 Apps and Office LTSC, allows remote code execution. An unauthenticated attacker can trigger it over the network, but a user must open a malicious document or follow a malicious link. Successful exploitation would give the attacker high impact on confidentiality, integrity and availability of the affected system.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build in the MSRC advisory (exact build unknown)
- Office 365 for Mac: before 16.114.26101123
- Office LTSC 2021 (Windows): before 16.0.14334.20974
- Office LTSC 2024 (Windows): before 16.0.17932.21056
- Office LTSC for Mac 2021 and 2024: before 16.114.26101123
Fixed in
- Office 365 for Mac: 16.114.26101123 or later
- Office LTSC 2021 (Windows): 16.0.14334.20974 or later
- Office LTSC 2024 (Windows): 16.0.17932.21056 per the CVE record; one third-party mirror lists 16.114.26101123, so verify on MSRC
- Office LTSC for Mac 2021 and 2024: 16.114.26101123 or later
- Microsoft 365 Apps for Enterprise: Unknown, see MSRC advisory
Workaround
Unknown. No workaround is documented in the sources. Apply the update.
Exploitation
- CISA SSVC: exploitation none, not automatable, technical impact total
- Not listed in CISA KEV
- Aggregators report no public exploit code; no known in-the-wild exploitation as of 31 October 2026
- EPSS 0.00618 from one aggregator (indicative only)
Our recommendation
- Install the October 2026 Office updates or later on all Office installations and confirm the fixed build on MSRC
- Verify that Office auto-updates are running, or deploy updates via WSUS, Intune or your update tool
- Keep Protected View enabled and block macros from untrusted sources
- Warn users not to open unexpected Word documents from email or links and monitor for signs of exploitation
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC advisory CVE-2026-108439 msrc.microsoft.com
- OpenCVE CVE-2026-108439 app.opencve.io
- CVE record mirror (threatint) cve.threatint.com
- VulDB CVE-2026-108439 vuldb.com
- TheHackerWire CVE-2026-108439 www.thehackerwire.com
- Vulners (EPSS) vulners.com
- Offseq threat radar CVE-2026-108439 radar.offseq.com
- Windows Update repost of MSRC note (secondary, unverified) thewindowsupdate.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:21.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.