CVE-2026-108443: Microsoft Office Word Remote Code Execution Vulnerability
Microsoft Office Word Remote Code Execution Vulnerability
Other sources
Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.114.26101123
Event History
Frequently Asked Questions
Does an attacker need an account or existing privileges to exploit this issue?
No. The vulnerability is rated PR:N, indicating that the attacker does not need privileges or authorization before exploitation.
Is user interaction required for exploitation?
Yes. The CVSS vector includes UI:R, so exploitation requires user interaction.
Which Office releases are listed as affected?
Affected software includes Microsoft 365 Apps for Enterprise; Office LTSC 2021 and 2024 for 32-bit and 64-bit editions; and Office LTSC for Mac 2021 and 2024, as well as Office 365 for Mac.
What could a successful exploit allow?
A successful exploit could allow code execution and is rated as having high impact on confidentiality, integrity, and availability.