AI analysis
CVE-2026-70269 is a heap-based buffer overflow in Microsoft Office Word, associated with an integer overflow (CWE-122 and CWE-190). Microsoft rates it as network-reachable remote code execution by an unauthorized attacker, with no privileges required and no user interaction, though attack complexity is high (CVSS 3.1 base score 8.1). Successful exploitation could let an attacker run code with the confidentiality, integrity, and availability impact of the Word process. Affected products named in the data are Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Apply Microsoft's October 2026 security updates for Word in Microsoft 365 Apps, Microsoft 365, Office 2021, and Office 2024 as soon as they are available for your channel. Until patches are deployed, reduce exposure of Word to untrusted network content and prioritize systems that open documents from email or the internet. No public proof-of-concept or known in-the-wild exploitation is reported; still treat this as a high-severity remote code execution fix.
Affected
| Microsoft 365 Apps | — |
| Microsoft 365 | — |
| Microsoft Office 2021 | — |
| Microsoft Office 2024 | — |
Estimated exposure
masson the order of 100 million+ Office/Microsoft 365 users — Microsoft 365 and desktop Office are the dominant productivity suites, with publicly reported subscriber and install bases well into the hundreds of millions, so a Word memory-corruption bug plausibly reaches a very large share of those…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.