Microsoft Office Word: Remote Code Execution through heap-based buffer overflow

Summary

A heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. Exploitation requires that a user opens a crafted document, for example one received by email, by download or from a file share. No credentials are needed on the attacker side, and no internet-facing service is involved.

Affected

• Microsoft 365 Apps for Enterprise: 16.0.1 to below the build listed in the MSRC update guide
• Office 365 for Mac: 1.0.0 to below 16.114.26101123
• Microsoft Office LTSC 2021: 16.0.1 to below 16.0.14334.20974
• Microsoft Office LTSC 2024: 16.0.0 to below 16.0.17932.21056
• Microsoft Office LTSC for Mac 2021: 16.0.1 to below 16.114.26101123
• Microsoft Office LTSC for Mac 2024: 16.0.0 to below 16.114.26101123

Fixed in

• Microsoft 365 Apps and Office LTSC 2021/2024 for Windows: fixed with the October 13, 2026 security update. Confirm the exact fixed build numbers in the MSRC table; the build numbers reported by third-party aggregators are not verified.
• Office for Mac (365 for Mac, LTSC for Mac 2021 and 2024): security update available according to the MSRC page. Exact Mac build numbers unverified.

Workaround

Unknown. No official Microsoft workaround was found in the sources. Check the MSRC page for a Mitigations section.

• Keep Protected View enabled for files from the internet and from email.
• Filter or sandbox inbound Office attachments.

Exploitation

• Microsoft rates exploit code maturity as 'Unproven' (E:U) at release.
• CISA SSVC (Vulnrichment): exploitation none, automatable no.
• Not listed in CISA KEV.
• EPSS score around 0.9 percent (Vulners).
• No public proof of concept or exploit found in a limited search. This is not confirmation that none exists.

Our recommendation

• Update Microsoft 365 Apps to a build at or above the fixed level for its update channel.
• Confirm that LTSC 2021 and LTSC 2024 installations include the October 2026 update.
• Update Office for Mac installations.
• Verify the build numbers against the MSRC table, not against aggregator figures.
• Keep Protected View enabled and filter Office attachments in email.
• Treat this as a regular patch-cycle item with high priority for endpoints that handle Word documents; no emergency action is indicated by current data.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70268 msrc.microsoft.com
• Microsoft Security Update Guide (en-US): CVE-2026-70268 msrc.microsoft.com
• Microsoft 365 Apps security updates (Microsoft Learn) learn.microsoft.com
• Vulners: NVD record CVE-2026-70268 vulners.com
• Vulners: MS:CVE-2026-70268 vulners.com
• OpenCVE: CVE-2026-70268 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:47.