CVE-2026-69742: CWE-190: Integer Overflow or Wraparound in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability involves an integer overflow or wraparound in Microsoft Office Publisher within Microsoft 365 Apps for Enterprise. An attacker can exploit this flaw to execute arbitrary code remotely without requiring privileges, though user interaction is needed. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific patched builds. Microsoft has published an official fix to remediate this issue.

Successful exploitation could allow remote code execution with high impact on confidentiality, integrity, and availability. The attacker does not require privileges but does require user interaction. This could lead to full compromise of affected systems running vulnerable versions of Microsoft 365 Apps for Enterprise.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69742. Since this is a cloud service and client application, Microsoft manages remediation for cloud components, but local application updates are necessary to fully mitigate the risk.