Microsoft Office Word: Heap-based buffer overflow allows remote code execution
Summary
A heap-based buffer overflow in Microsoft Word, part of Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024, allows an unauthenticated attacker to execute code over a network. Exploitation requires that a victim opens a crafted Word document or otherwise interacts with it (UI:R). The CVSS base score is 8.8 (High), and the CNA and NVD vector assigns high impact to confidentiality, integrity and availability.
Affected
- Microsoft 365 Apps for Enterprise (16.0.1 up to the fixed build; exact build unknown)
- Microsoft Office LTSC 2021: 16.0.1 before 16.0.14334.20974
- Microsoft Office LTSC 2024: 16.0.0 before 16.0.17932.21056
Fixed in
- Microsoft Office LTSC 2021: 16.0.14334.20974 or later
- Microsoft Office LTSC 2024: 16.0.17932.21056 or later
- Microsoft 365 Apps for Enterprise: Unknown. Check the MSRC advisory for the fixed build.
Workaround
Unknown. No workaround was found in the sources. Installing the security update is the remedy.
Exploitation
- CISA SSVC: exploitation none, not automatable
- Not listed in the CISA KEV catalog
- No public proof of concept known at the time of research
Our recommendation
- Install the Microsoft Office security update through Microsoft Update on all Microsoft 365 Apps and Office LTSC 2021/2024 installations, with priority
- Verify the installed build against the MSRC advisory, especially for Microsoft 365 Apps
- Keep Protected View enabled and restrict or scan Word attachments in email
- Train users to be cautious with unsolicited documents and links
- Monitor for exploitation indicators and watch the CISA KEV catalog
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-108447 msrc.microsoft.com
- OpenCVE: CVE-2026-108447 app.opencve.io
- VulDB: CVE-2026-108447 vuldb.com
- ThreatInt: CVE-2026-108447 cve.threatint.com
- The Hacker Wire: CVE-2026-108447 www.thehackerwire.com
- Strix AI: CVE-2026-108447 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:15.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.