CVE-2026-62804: Microsoft Word Remote Code Execution Vulnerability
Published Sep 8, 2026
·Updated
External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Other sources
Microsoft Word Remote Code Execution Vulnerability
— Microsoft
Affected Software
24 affected componentsFixes available
Microsoft Office 365 for Mac
Microsoft Office LTSC 2024 for 64-bit editions<16.0.17932.20960
16.0.17932.20960
Microsoft Office LTSC 2024 for 32-bit editions<https://aka.ms/OfficeSecurityReleases
https://aka.ms/OfficeSecurityReleases
Microsoft Office 2016<16.0.5569.1002
16.0.5569.1002
Microsoft Office LTSC 2021 for 32-bit editions<https://aka.ms/OfficeSecurityReleases
https://aka.ms/OfficeSecurityReleases
Microsoft Office 2016<16.0.5569.1002
16.0.5569.1002
Microsoft Office LTSC for Mac 2021
Microsoft Office LTSC 2021 for 64-bit editions<https://aka.ms/OfficeSecurityReleases
https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise<https://aka.ms/OfficeSecurityReleases
https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps for Enterprise<https://aka.ms/OfficeSecurityReleases
https://aka.ms/OfficeSecurityReleases
Microsoft Office 2019 for 64-bit editions<https://aka.ms/OfficeSecurityReleases
https://aka.ms/OfficeSecurityReleases
Microsoft Office 2019 for 32-bit editions<https://aka.ms/OfficeSecurityReleases
https://aka.ms/OfficeSecurityReleases
Microsoft 365 Apps
Microsoft 365 Apps
Microsoft Microsoft 365 Macos
Microsoft Office 2016
Microsoft Office 2016
Microsoft Office 2019
Microsoft Office 2019
Microsoft Office 2021
Microsoft Office 2021
Microsoft Office 2021 Macos
Microsoft Office 2024
Microsoft Office 2024
Remediation
Event History
Sep 8, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·02:00 PM
Affected Software
Updated
via Microsoft·02:00 PM
Description
CVE Published
via MITRE·05:19 PM
Data Sourced
via MITRE·05:19 PM
DescriptionSeverity
Data Sourced
via NVD·06:18 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What access and conditions does exploitation require?
The vulnerability has a local attack vector and requires user interaction. The attacker does not need privileges before exploitation.
2
Which Microsoft Office products are listed as affected?
The affected software list includes Microsoft Office 2016; Microsoft 365 Apps for Enterprise; Microsoft Office 365 for Mac; Office LTSC 2024 for 32-bit and 64-bit editions; Office LTSC 2021 for 32-bit and 64-bit editions; and Office LTSC for Mac 2021.
3
What could a successful exploit affect?
The severity vector rates confidentiality, integrity, and availability impacts as high. Successful exploitation can therefore have high impact across all three areas.