CVE-2026-108441: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-108441) is a heap-based buffer overflow in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker over a network. The CVSS 3.1 vector indicates it is exploitable remotely with low attack complexity and no privileges required, but user interaction is needed. The impact includes high confidentiality, integrity, and availability consequences. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The affected versions include multiple version ranges within 16.x and earlier versions as specified.

Successful exploitation allows an attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected system, including data confidentiality, integrity, and availability impacts. The vulnerability is rated high severity with a CVSS score of 8.8. No active exploitation in the wild has been reported to date.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft promptly. Since this is a cloud-hosted service, Microsoft manages remediation for the cloud environment. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108441 for detailed patch and update instructions.