CVE-2026-108432: Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Other sources
Microsoft Office Word Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.114.26101123 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases
Event History
Frequently Asked Questions
Which deployments are in scope?
The affected software list includes Microsoft 365 Apps for Enterprise; Office LTSC 2021 and 2024 for 32-bit and 64-bit editions; Office 365 for Mac; and Office LTSC for Mac 2021 and 2024.
What does an attacker need to exploit this issue?
The attacker does not need prior privileges and can attack over a network, but user interaction is required. The supplied information does not specify the exact user action or document-delivery method involved.
How can I identify potentially affected endpoints?
Inventory systems for the listed Microsoft Office and Microsoft 365 products, including Mac installations and both 32-bit and 64-bit LTSC editions. The supplied data does not provide affected or fixed build numbers.