CVE-2026-77901: CWE-476: NULL Pointer Dereference in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability, identified as CVE-2026-77901 and classified under CWE-476 (NULL Pointer Dereference), affects Microsoft 365 Apps for Enterprise. It allows an attacker to cause a null pointer dereference in Microsoft Office Word, which can lead to remote code execution without requiring privileges but with user interaction. The CVSS 3.1 base score is 8.8, indicating high severity, with impact on confidentiality, integrity, and availability. Multiple version ranges are affected, and Microsoft has issued an official fix. The vulnerability is publicly disclosed and documented in the Microsoft Security Response Center advisory.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on a vulnerable system, potentially leading to full compromise of the affected application and associated data. The vulnerability impacts confidentiality, integrity, and availability of the system. However, exploitation requires user interaction and no privileges are needed by the attacker.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77901. Since this is a cloud-hosted service, Microsoft manages remediation server-side. No additional mitigation actions are required beyond applying the official fix.