CVE-2026-69764

CVE-2026-69764 is a heap-based buffer overflow (CWE-122) in Microsoft Word's processing of documents. An attacker triggers it by convincing a user to open a maliciously crafted file: the attack vector is network-based and requires no privileges or credentials, but it does require user interaction, after which the flaw lets the attacker execute arbitrary code in the context of the logged-in user. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.8, High). Affected users include anyone running the Word component of Microsoft 365 Apps or the standalone Office 2016, 2019, 2021, and 2024 releases. Exploitation has not yet been observed: the flaw is not in CISA's KEV, no public proof-of-concept is known, and EPSS estimates only a ~0.8% probability of exploitation within 30 days.

What to do: Apply Microsoft's security updates for Word across all affected channels (Microsoft 365 Apps and Office 2016/2019/2021/2024) as published in Microsoft's advisory, prioritizing workstations that regularly open files from external sources, and check the advisory for the exact fixed build for each version. Because exploitation requires a user to open a crafted document, reinforce caution with untrusted email attachments and downloaded files until patches are deployed. No public PoC or in-the-wild exploitation is known, so patching during the regular cycle is reasonable, but high-exposure users (front-office, helpdesk, users of shared file shares) should be patched first.