CVE-2026-69556: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-69556) is a heap-based buffer overflow in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker over a network. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability affects specific versions including 16.0.0, 16.0.1, 19.0.0, and versions from 16.0.1 up to but not including 16.0.5569.1002. Microsoft has released an official fix for this vulnerability. There are no known exploits in the wild at this time.

Successful exploitation of this heap-based buffer overflow could allow an attacker to execute arbitrary code remotely with no privileges required and only user interaction needed. This can lead to full compromise of the affected system, impacting confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Microsoft 365 Apps for Enterprise to remediate this vulnerability. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69556 for detailed patch information and deployment guidance.