CVE-2026-78507: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-78507 is a use-after-free vulnerability (CWE-416) in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. This vulnerability enables an attacker to execute arbitrary code remotely without privileges, requiring user interaction. The vulnerability affects multiple version ranges of Microsoft 365 Apps for Enterprise prior to various build numbers. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthorized attacker to execute arbitrary code remotely on affected Microsoft 365 Apps for Enterprise installations, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability with high severity.

An official fix is available from Microsoft. Users and administrators should apply the latest updates for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78507. Since this is a cloud-hosted service, Microsoft manages remediation server-side, but client updates are necessary to fully mitigate the vulnerability.