CVE-2026-78511

CVE-2026-78511 is a heap-based buffer overflow (CWE-122) in Microsoft Word that can be reached over a network. Triggering it requires user interaction: an attacker must persuade a user to open a maliciously crafted Word document, since the CVSS vector shows UI:R with no privileges required. A successful exploit allows an unauthenticated attacker to execute arbitrary code in the context of the victim user, with high impact on confidentiality, integrity, and availability at that user's privilege level. Affected products include Word as shipped in Microsoft 365/Microsoft 365 Apps and perpetual Office 2019, Office 2021, and Office 2024. There is no confirmed exploitation yet: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates only a 0.8% chance of exploitation in the next 30 days.

What to do: Apply the patched Word/Office builds listed in Microsoft's security advisory as soon as they are available for your update channel, and confirm Microsoft 365 Apps servicing is current. Until patched, treat unsolicited Word documents (.doc/.docx, including in email) with suspicion and rely on Protected View and attachment-scanning controls as interim mitigation. Monitor KEV and exploit feeds, since a network-reachable Word RCE is likely to draw attacker attention once a PoC appears.