EUVD-2026-56694
GHSA-q4mx-rwhg-jjg4
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector and required user interaction align with document-open exploitation; PR:N reflects that any user may open a file without prior system privileges.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AnalysisAI
Stack-based buffer overflow in Microsoft Office Word enables arbitrary code execution when a victim opens a specially crafted document, affecting Word 2016 through Microsoft 365 Apps and Office LTSC 2024 on both Windows and macOS. The flaw (CWE-121) scores CVSS 7.8 with high impacts across confidentiality, integrity, and availability, constrained by local attack vector and mandatory user interaction. No public exploit has been identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.
Technical ContextAI
CWE-121 (Stack-Based Buffer Overflow) occurs when data written to a stack-allocated buffer exceeds its declared boundary, overwriting adjacent stack memory such as return addresses or saved frame pointers, allowing control-flow hijacking. In Microsoft Word's document parsing routines, a specially crafted file triggers this overflow condition. The CVSS vector (AV:L/UI:R) confirms the exploit fires within the local process context at the moment Word parses the malicious document - the attacker does not need network-level reach once the file is on disk. Affected product lines span Windows and macOS across multiple Office release channels: Microsoft Word 2016 (16.x), Microsoft Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise (Windows), and Office LTSC for Mac 2021/2024 and Office 365 for Mac (macOS, all at the 16.x build train below 16.112.26081010).
RemediationAI
Apply the vendor-released patch immediately. For Windows installations, update via Microsoft Update or the Office Update catalog at https://aka.ms/OfficeSecurityReleases - Microsoft Word 2016 is patched at build 16.0.5565.1000; Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise receive fixes through the same channel. For macOS, update to Office build 16.112.26081010 or later for Office LTSC for Mac 2021, Office LTSC for Mac 2024, and Office 365 for Mac. As a compensating control prior to patching, enforce Protected View via Group Policy to open all externally received or internet-sourced documents in read-only mode, which prevents the vulnerable parsing path from executing embedded content - note this may disrupt workflows that rely on immediate editing of received documents. Additionally, consider deploying Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint to block Office applications from spawning child processes, limiting post-exploitation pivot potential even if the overflow fires. These controls reduce risk but do not eliminate the vulnerability; patching remains the required remediation.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today