Sep 2026: Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-78512 Published on September 8, 2026

Microsoft Office Word Remote Code Execution Vulnerability
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Vendor Advisory NVD

Weakness Types

Numeric Truncation Error

Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. When a primitive is cast to a smaller primitive, the high order bits of the large value are lost in the conversion, potentially resulting in an unexpected value that is not equal to the original value. This value may be required as an index into a buffer, a loop iterator, or simply necessary state data. In any case, the value cannot be trusted and the system will be in an undefined state. While this method may be employed viably to isolate the low bits of a value, this usage is rare, and truncation usually implies that an implementation error has occurred.

Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().


Products Associated with CVE-2026-78512

Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.

Microsoft Office 2019
 
Microsoft 365 Apps
 
Microsoft Office Macos 2021
 
Microsoft Office 2021
 
Microsoft Office 2024
 
Microsoft Office Macos 2024
 
Microsoft Office 2016
 
Microsoft Word 2016
 
Microsoft Office 365
 

Affected Versions

Microsoft 365 Apps for Enterprise: Microsoft Office 2016: Microsoft Office 2019: Microsoft Office 365 for Mac: Microsoft Office LTSC 2021: Microsoft Office LTSC 2024: Microsoft Office LTSC for Mac 2021: Microsoft Office LTSC for Mac 2024: Microsoft Word 2016: