Microsoft Office: Remote code execution via heap-based buffer overflow

Summary

A heap-based buffer overflow in Microsoft Office allows an unauthorized remote attacker to execute code on the affected system. The attack requires no privileges but user interaction, for example opening a crafted document. A successful attack could impact confidentiality, integrity and availability.

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build listed in the Microsoft release notes
• Microsoft Office LTSC 2021: 16.0.1 before 16.0.14334.21048
• Microsoft Office LTSC 2024: 16.0.0 before 16.0.17932.21140

Fixed in

• Microsoft Office LTSC 2021: 16.0.14334.21048
• Microsoft Office LTSC 2024: 16.0.17932.21140
• Microsoft 365 Apps for Enterprise: Unknown (see https://aka.ms/OfficeSecurityReleases)

Workaround

Unknown. No vendor-confirmed workaround. Installing the security update is the remedy.

Exploitation

• No evidence of exploitation in the wild found at publication.
• Not listed in CISA KEV according to a third-party aggregator; verify against the CISA catalogue.
• No public proof of concept found.

Our recommendation

• Install the Microsoft 365 Apps updates and the LTSC 2021 and LTSC 2024 builds as a priority.
• Verify the installed build numbers on all Office clients.
• Use caution when opening documents from email or untrusted sources until patched.
• Monitor the MSRC advisory and CISA KEV for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center advisory msrc.microsoft.com
• CVE.org record www.cve.org
• Strix.ai (secondary source) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:18.