CVE-2026-96996: Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Other sources
Microsoft Office Word Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.17932.21056 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.0.14334.20974 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in https://aka.ms/OfficeSecurityReleases
Event History
Frequently Asked Questions
Which Office products are identified as affected?
The affected software list includes Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021 for 32-bit and 64-bit editions, and Microsoft Office LTSC 2024 for 32-bit and 64-bit editions.
What access does an attacker need to exploit this issue?
The CVSS vector indicates a local attack vector and no privileges required. User interaction is required, so exploitation depends on a user performing an action.
Is this described as remotely exploitable over the network?
No. The supplied CVSS vector specifies AV:L, indicating a local attack vector rather than a network-based one.