Windows Rich Text Edit Control: Heap-based buffer overflow leads to code execution

Summary

A heap-based buffer overflow in the Windows Rich Text Edit Control allows an unauthenticated attacker to execute code over the network. The CVSS base score is 9.8 (critical) because no privileges or user interaction are required. Microsoft rates the severity as Important and reports no known exploitation at publication. The delivery method (for example a crafted document or web content) is not stated in the sources.

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 to before the build listed in the Microsoft Office security release notes
• Microsoft Office 365 for Mac: 1.0.0 to before 16.114.26101123
• Microsoft Office LTSC 2021: 16.0.1 to before 16.0.14334.20974
• Microsoft Office LTSC 2024: 16.0.0 to before 16.0.17932.21056
• Microsoft Office LTSC for Mac 2021: 16.0.1 to before 16.114.26101123
• Microsoft Office LTSC for Mac 2024: 16.0.0 to before 16.114.26101123
• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231

Fixed in

• Fixed in the October 2026 security updates for the listed Windows and Office builds (fixed builds as stated in the CVE record; to be confirmed on the MSRC product table)
• Windows 11 24H2: 10.0.26100.9711
• Windows 11 23H2: 10.0.22631.7652
• Windows 10 22H2: 10.0.19045.7807
• Windows 10 1809: 10.0.17763.9376
• Windows 10 1607: 10.0.14393.9612

Workaround

Unknown.

Exploitation

• Microsoft assessment at publication: not publicly disclosed, not exploited, exploitation unlikely
• CISA SSVC: exploitation none, automatable yes, technical impact total
• Not listed in the CISA KEV catalogue at the time of research
• EPSS score: 0.00958 (about 1 percent)
• No public proof-of-concept found; status not reported

Our recommendation

• Treat as high priority and install the October 2026 cumulative updates for Windows and Microsoft 365/Office on all affected systems
• Prioritise systems that open external documents, email attachments or rich text content
• Confirm target builds in the MSRC product table before rollout
• Check whether any Windows Server 2012 or 2012 R2 systems are affected and whether Extended Security Updates apply
• Monitor for public proof-of-concept code or addition to the CISA KEV catalogue and re-assess if either occurs

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (CVE-2026-70096) msrc.microsoft.com
• Microsoft Security Update Guide, en-US msrc.microsoft.com
• Vulners MSCVE record vulners.com
• Vulners NVD record vulners.com
• Vulners Rapid7 record vulners.com
• OpenCVE record app.opencve.io
• Strix CVE record www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:47.