CVE-2026-108427: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-108427) is a heap-based buffer overflow in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. It enables unauthorized remote code execution over a network. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The affected versions are explicitly identified as =16.0.1, >=16.0.1 <16.0.14334.20974, and >=16.0.0 <16.0.17932.21056. No active exploitation has been observed so far.

Successful exploitation allows an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system running Microsoft 365 Apps for Enterprise Word. This can be triggered over a network without requiring privileges but does require user interaction.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise to remediate this vulnerability. Since this is a cloud-hosted service, Microsoft manages remediation server-side; verify the vendor advisory for update status. No additional mitigation steps are indicated by the vendor advisory.