CVE-2026-81385

CVE-2026-81385 is a high-severity (CVSS 8.8) deserialization of untrusted data flaw (CWE-502) in Microsoft Office Publisher that allows an unauthorized attacker to execute code over a network. The network attack vector combined with the required user interaction indicates a client-side attack pattern: an attacker would most plausibly deliver a maliciously crafted Publisher document (e.g., via email or download), and code execution is triggered when the victim opens or processes it, with no authentication or privileges needed on the target beforehand. Successful exploitation yields arbitrary code execution on the victim's machine in the context of the user, with high impact on confidentiality, integrity, and availability. Anyone running Microsoft Office Publisher, which is typically installed as part of Microsoft 365/Office desktop suites on Windows endpoints, is affected. There is no known public proof-of-concept and the issue is not in CISA's KEV; EPSS currently puts 30-day exploitation probability at about 1% (62nd percentile), indicating a moderate-to-low likelihood of imminent in-the-wild exploitation.

What to do: Apply Microsoft's security update for Publisher as soon as it is available through Windows Update/the Office update channel and verify your Publisher build against the MSRC advisory for CVE-2026-81385. Until patched, treat unsolicited .pub files from untrusted sources with suspicion and consider filtering .pub attachments at the mail gateway. Note that Publisher is scheduled for retirement by Microsoft in October 2026, so fold migration planning into remediation.