Microsoft Office: Heap-based buffer overflow allows remote code execution
Summary
A heap-based buffer overflow in Microsoft Office allows an unauthenticated attacker to execute code over a network, as classified by Microsoft (CWE-122). The CVSS 3.1 base score is 8.8 (High). Exploitation requires user interaction, and the trigger is not confirmed in the sources, so it is unknown whether opening a crafted document or file is the vector.
Affected
- Microsoft 365 Apps for Enterprise from 16.0.1 (before the fixed build listed on the MSRC page)
- Office LTSC 2021 from 16.0.1
- Office LTSC 2024 from 16.0.0
- Microsoft Office 365 for Mac and Office LTSC for Mac 2021/2024 from 16.0.0 or 16.0.1 (before 16.114.26101123)
Fixed in
- Microsoft released fixes on 13 Oct 2026.
- Office 365 for Mac and LTSC for Mac: 16.114.26101123 according to the CNA record (verify on MSRC).
- Windows fixed builds for LTSC 2021 and LTSC 2024: unverified, as sources conflict. Check the MSRC page and Microsoft release notes before relying on any build number.
Workaround
Unknown. No vendor-documented workaround was found. Applying the security update is the recommended remediation.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC data: exploitation none, automatable no, technical impact total.
- No confirmed in-the-wild exploitation known.
- No public proof-of-concept found in searches, which does not prove none exists.
Our recommendation
- Patch Microsoft 365 Apps and Office on Windows and Mac as a priority, especially on systems that handle mail and documents from external sources.
- Confirm installed build numbers against the MSRC page, not third-party aggregators.
- Monitor for public exploit code or a CISA KEV entry, which would increase urgency.
- Restrict exposure of Office handling of untrusted files where feasible.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-88196 msrc.microsoft.com
- Microsoft 365 Apps security updates learn.microsoft.com
- CVE record via Vulners (CVELIST) vulners.com
- CVE record via OpenCVE app.opencve.io
- Microsoft customer risk document 2026 CVEs cdn-dynmedia-1.microsoft.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:58.
Original description (NVD)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.