CVE-2026-78504

CVE-2026-78504 is a stack-based buffer overflow (CWE-121) in Microsoft Word, the word-processing component bundled with Microsoft 365 Apps/Microsoft 365 and Office 2019, 2021, and 2024, which allows an unauthorized attacker to execute code over a network. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the attack requires no authentication or privileges but does require user interaction, most likely a user opening or previewing crafted content processed by Word. A successful exploit would let the attacker run arbitrary code in the context of the user opening the content, with high impact on confidentiality, integrity, and availability of that system. All users of the affected Office editions are potentially exposed, since Word is a core component of each. As of this writing the flaw is not in CISA's Known Exploited Vulnerabilities catalog, no public proof-of-concept is known, and EPSS estimates only about a 0.6% probability of exploitation within 30 days.

What to do: Check Microsoft's advisory for CVE-2026-78504 for the affected and fixed Word/Office build numbers (not included in this data) and deploy the corresponding security update via Microsoft Update as soon as it is available. Until patched, discourage opening or previewing Word documents from untrusted sources, and inventory endpoints running Office 2019/2021/2024 and Microsoft 365 Apps so patch progress can be tracked and high-risk users prioritized.