Microsoft Office Word: Remote code execution via uninitialized resource

Summary

A flaw in Microsoft Office Word allows remote code execution through the use of an uninitialized resource (CWE-908). The CVSS base score is 8.8 and Microsoft rates it Important. An attacker can run code on a victim's computer by sending a malicious document that the user opens, for example by email or download, and no account is needed. The vulnerability is not exposed on internet-facing services and no public exploit or active exploitation is known.

Affected

• Microsoft 365 Apps for Enterprise (16.0.1 up to the fixed build)
• Microsoft Office LTSC 2021 (16.0.1 to before 16.0.14334.20974)
• Microsoft Office LTSC 2024 (16.0.0 to before 16.0.17932.21056)
• Microsoft Office 365 for Mac (1.0.0 to before 16.114.26101123)
• Microsoft Office LTSC for Mac 2021 and 2024 (before 16.114.26101123)
• Unknown: whether other Office builds are affected

Fixed in

• Microsoft has released fixes on 13 October 2026 (Patch Tuesday).
• Office LTSC 2021: 16.0.14334.20974 or later (build 14334.20974 per Microsoft release notes).
• Office LTSC 2024: 16.0.17932.21056 or later (build 17932.21056 per Microsoft release notes).
• Office for Mac and LTSC for Mac: 16.114.26101123 or later.
• Microsoft 365 Apps: install the current October 2026 update (Monthly Enterprise Channel 2609, build 20430.20180 or later).
• The exact minimum build per product was not confirmed on the MSRC page; verify it before rollout.

Workaround

Unknown. Microsoft has not published a workaround; the update is the remedy.

• General hardening, not from the vendor: keep Protected View enabled for documents from the internet and email, block or sandbox risky attachment types at the mail gateway, and consider Attack Surface Reduction rules for Office applications.

Exploitation

• Microsoft lists the vulnerability as not publicly disclosed, with exploit code maturity 'Unproven'.
• Not listed in CISA KEV; EPSS score below 1%.
• CISA SSVC: exploitation 'none', automatable 'no'.
• No public proof of concept or exploitation in the wild is known.

Our recommendation

• Deploy the October 2026 Office security updates to all affected clients with high priority, as phishing with Office documents is common.
• Verify the installed build against the MSRC advisory for each product.
• Identify clients still running Office LTSC 2021; support ended on 13 October 2026 and they receive no further security updates, so plan an upgrade.
• Keep Protected View enabled and monitor mail gateways for suspicious Office attachments.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC advisory CVE-2026-88150 msrc.microsoft.com
• Microsoft Office security update release notes learn.microsoft.com
• Microsoft 365 Apps update history learn.microsoft.com
• OpenCVE (NVD data, KEV, EPSS, SSVC) app.opencve.io
• Vulners CVE record vulners.com
• Office-watch October 2026 Patch Tuesday office-watch.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:08.