CVE-2026-108437: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-108437) is a heap-based buffer overflow in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker over a network. The flaw is identified as CWE-122 and has a CVSS 3.1 base score of 8.8, indicating high severity. The affected versions include =16.0.1, >=16.0.1 <16.0.14334.20974, and >=16.0.0 <16.0.17932.21056. Microsoft has published an official security update to remediate this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely with no privileges required and only user interaction needed. The impact includes complete confidentiality, integrity, and availability compromise of the affected system. This could lead to full system takeover or data compromise.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108437. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Ensure all affected versions are updated to the fixed versions to mitigate this vulnerability.