CVE-2026-78502: Microsoft Office Word Information Disclosure Vulnerability

Q: What must an attacker do to exploit this issue?

The attacker must cause a user to interact with malicious content; the available scoring data indicates user interaction is required. No attacker privileges are required, and the attack can be conducted over a network.

Q: What is the expected impact if exploitation succeeds?

Successful exploitation can disclose information from Word through an out-of-bounds read. The provided impact data indicates high confidentiality impact, with no indicated integrity or availability impact.

Q: Which Word product families are listed as affected?

The affected software list includes Word 2016, Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC for Mac 2024, and Office LTSC 2021 and 2024 for both 32-bit and 64-bit editions where listed.

Published Sep 8, 2026

Updated

Microsoft Office Word Information Disclosure Vulnerability

Other sources

Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.

— Microsoft

Affected Software

13 affected componentsFixes available

Microsoft Office 365 for Mac

Microsoft Word 2016<16.0.5569.1000

16.0.5569.1000

Microsoft Office LTSC for Mac 2024

Microsoft Word 2016<16.0.5569.1000

16.0.5569.1000

Microsoft Office LTSC 2021 for 64-bit editions<16.0.14334.20906

16.0.14334.20906

Microsoft Office LTSC 2021 for 32-bit editions<16.0.14334.20906

16.0.14334.20906

Microsoft Office LTSC 2024 for 32-bit editions<16.0.17932.20976

16.0.17932.20976

Microsoft Office LTSC 2024 for 64-bit editions<16.0.17932.20976

16.0.17932.20976

Microsoft 365 Apps for Enterprise<16.0.20326.20138

16.0.20326.20138

Microsoft Office LTSC for Mac 2021

Microsoft 365 Apps for Enterprise<16.0.20326.20138

16.0.20326.20138

Microsoft Office 2019 for 64-bit editions<16.0.10417.20207

16.0.10417.20207

Microsoft Office 2019 for 32-bit editions<16.0.10417.20207

16.0.10417.20207

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.5569.1000Patch KB5002923
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.20976
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20906
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.20326.20138
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.10417.20207

Event History

Sep 8, 2026

CVE Published

via Microsoft·02:00 PM

Data Sourced

via Microsoft·02:00 PM

DescriptionSeverityWeaknessAffected Software

Updated

via Microsoft·02:00 PM

Affected Software

Updated

via Microsoft·02:00 PM

Description

CVE Published

via MITRE·05:13 PM

Data Sourced

via MITRE·05:13 PM

DescriptionSeverity

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must cause a user to interact with malicious content; the available scoring data indicates user interaction is required. No attacker privileges are required, and the attack can be conducted over a network.

What is the expected impact if exploitation succeeds?

Successful exploitation can disclose information from Word through an out-of-bounds read. The provided impact data indicates high confidentiality impact, with no indicated integrity or availability impact.

Which Word product families are listed as affected?

The affected software list includes Word 2016, Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC for Mac 2024, and Office LTSC 2021 and 2024 for both 32-bit and 64-bit editions where listed.

CVE-2026-78502: Microsoft Office Word Information Disclosure Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the expected impact if exploitation succeeds?

Which Word product families are listed as affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the expected impact if exploitation succeeds?

Which Word product families are listed as affected?