CVE-2026-69742: Microsoft Office Publisher Remote Code Execution Vulnerability
Published Sep 8, 2026
·Updated
Integer overflow or wraparound in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.
Other sources
Microsoft Office Publisher Remote Code Execution Vulnerability
— Microsoft
Affected Software
20 affected componentsFixes available
Microsoft Publisher 2016<16.0.5569.1000
16.0.5569.1000
Microsoft Office LTSC 2021 for 32-bit editions<16.0.14334.20906
16.0.14334.20906
Microsoft Publisher 2016<16.0.5569.1000
16.0.5569.1000
Microsoft Office LTSC 2024 for 32-bit editions<16.0.17932.20976
16.0.17932.20976
Microsoft Office LTSC 2024 for 64-bit editions<16.0.17932.20976
16.0.17932.20976
Microsoft Office LTSC 2021 for 64-bit editions<16.0.14334.20906
16.0.14334.20906
Microsoft 365 Apps for Enterprise<16.0.20326.20138
16.0.20326.20138
Microsoft 365 Apps for Enterprise<16.0.20326.20138
16.0.20326.20138
Microsoft Office 2019 for 64-bit editions<16.0.10417.20207
16.0.10417.20207
Microsoft Office 2019 for 32-bit editions<16.0.10417.20207
16.0.10417.20207
Microsoft 365 Apps
Microsoft 365 Apps
Microsoft Office 2019
Microsoft Office 2019
Microsoft Office 2021
Microsoft Office 2021
Microsoft Office 2024
Microsoft Office 2024
Microsoft Publisher=2016
Microsoft Publisher=2016
Remediation
Event History
Sep 8, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·02:00 PM
Affected Software
Updated
via Microsoft·02:00 PM
Description
CVE Published
via MITRE·05:13 PM
Data Sourced
via MITRE·05:13 PM
DescriptionSeverity
Data Sourced
via NVD·06:19 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Does exploitation require the attacker to have an account or prior privileges?
No. The CVSS vector indicates no privileges are required (PR:N), so an unauthorized attacker can attempt exploitation.
2
Is user involvement required for exploitation?
Yes. The CVSS vector indicates user interaction is required (UI:R). The available information does not specify the exact interaction needed.
3
Which Microsoft Publisher deployments are listed as affected?
The affected software list includes Microsoft Publisher 2016; Microsoft 365 Apps for Enterprise; Office 2019 for 32-bit and 64-bit editions; Office LTSC 2021 for 32-bit and 64-bit editions; and Office LTSC 2024 for 32-bit and 64-bit editions.