Microsoft Office Word: Heap-based buffer overflow allows remote code execution
Summary
A heap-based buffer overflow in Microsoft Office Word allows an unauthenticated attacker to execute code over a network. The attack requires a user to open a manipulated document, most likely delivered by email. Microsoft rates the flaw as Important with a CVSS base score of 8.8.
Affected
- Microsoft 365 Apps for Enterprise (versions 16.0.1 up to the October 2026 fixed build)
- Microsoft Office 365 for Mac (versions 1.0.0 to before 16.114.26101123)
- Microsoft Office LTSC 2021 (versions 16.0.1 to before 16.0.14334.20974)
- Microsoft Office LTSC 2024 (versions 16.0.0 to before 16.0.17932.21056)
- Microsoft Office LTSC for Mac 2021 (versions 16.0.1 to before 16.114.26101123)
- Microsoft Office LTSC for Mac 2024 (versions 16.0.0 to before 16.114.26101123)
Fixed in
- Microsoft 365 Apps: October 2026 security update (exact build unknown)
- Office LTSC 2021: 16.0.14334.20974 (build number not yet confirmed by Microsoft)
- Office LTSC 2024: 16.0.17932.21056 (build number not yet confirmed by Microsoft)
- Office LTSC for Mac 2021 and 2024: no update available yet at the time of research
Workaround
Unknown. Microsoft has released a patch, and no documented workaround was found in the sources.
Exploitation
- No known exploitation as of 31 Oct 2026 (search-based finding, not a formal Microsoft statement)
- Not on Microsoft's list of exploited vulnerabilities for October 2026
- No public proof of concept found
- Microsoft exploit code maturity: unproven (E:U); EPSS 0.00912 (third-party estimate)
Our recommendation
- Patch Microsoft 365 Apps and Office LTSC with the October 2026 security update and confirm the fixed build in the MSRC Security Update Guide before rollout
- Plan the update for Office LTSC for Mac 2021 and 2024 as soon as Microsoft releases it
- Identify Office 2021 installations; Office 2021 receives its last security update, so plan an upgrade
- Keep Protected View enabled and filter or quarantine attachments from untrusted senders until patching is complete
- Train users to be careful with unexpected document attachments
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC advisory CVE-2026-70302 msrc.microsoft.com
- Microsoft 365 Apps security updates (release notes) learn.microsoft.com
- Office Watch: October 2026 Patch Tuesday Office fixes office-watch.com
- Action1: Patch Tuesday October 2026 www.action1.com
- Vulners NVD record (EPSS) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:43.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.