CVE-2026-69671: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-69671) is a heap-based buffer overflow in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker over a network. The CVSS 3.1 vector indicates it requires no privileges but user interaction and has high impact on confidentiality, integrity, and availability. Multiple version ranges prior to fixed builds are affected. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No active exploitation has been reported.

Successful exploitation could allow an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the application and underlying system. The vulnerability is exploitable over the network without privileges but requires user interaction.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69671). Since this is a cloud-hosted service, Microsoft manages remediation server-side for cloud instances. No additional mitigation actions are indicated by the vendor.