CVE-2026-108428: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-108428) is a heap-based buffer overflow in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker over a network. The CVSS 3.1 base score is 8.8, indicating high severity, with attack vector network, low attack complexity, no privileges required, and user interaction required. Confidentiality, integrity, and availability impacts are all high. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The affected versions include exactly 16.0.1, versions from 16.0.1 up to but not including 16.0.14334.20974, and versions from 16.0.0 up to but not including 16.0.17932.21056.

Successful exploitation allows an attacker to execute arbitrary code remotely on affected Microsoft 365 Apps for Enterprise installations, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability with high severity. No known exploits are currently active in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as soon as possible. Since this is a cloud service, Microsoft manages remediation server-side; verify update status via the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108428.