CVE-2026-62804: Microsoft Word Remote Code Execution Vulnerability
External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Other sources
Microsoft Word Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.20960 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.5569.1002Patch KB5002923
Event History
Frequently Asked Questions
What access and conditions does exploitation require?
The vulnerability has a local attack vector and requires user interaction. The attacker does not need privileges before exploitation.
Which Microsoft Office products are listed as affected?
The affected software list includes Microsoft Office 2016; Microsoft 365 Apps for Enterprise; Microsoft Office 365 for Mac; Office LTSC 2024 for 32-bit and 64-bit editions; Office LTSC 2021 for 32-bit and 64-bit editions; and Office LTSC for Mac 2021.
What could a successful exploit affect?
The severity vector rates confidentiality, integrity, and availability impacts as high. Successful exploitation can therefore have high impact across all three areas.