CVE-2026-77898

Microsoft Office is affected by a heap-based buffer overflow (CWE-122) that allows an unauthorized attacker to execute code over a network. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates exploitation requires user interaction and is of high attack complexity, consistent with a scenario in which a victim opens or processes specially crafted content in an Office application. A successful attack yields high impact to confidentiality, integrity, and availability on the affected system. Users of Microsoft 365 Apps, Microsoft 365, and the perpetual-license releases Office 2019, Office 2021, and Office 2024 are in scope, though specific vulnerable builds are not enumerated in the available data. There is no current evidence of exploitation: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates only a 0.5% probability of exploitation within 30 days.

What to do: Monitor Microsoft's security advisory for this CVE to identify affected builds and apply the Office security update as soon as it is available, prioritizing users who regularly handle untrusted documents. Until patched, rely on Office Protected View policies, email attachment filtering, and user caution with unexpected files as interim mitigations. Defender teams should watch for Microsoft or third-party proof-of-concept code, since exploitation status may change quickly once a PoC appears.