CVE-2026-78510: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability involves a heap-based buffer overflow in Microsoft Office components within Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute arbitrary code locally on the affected system. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to specific fixed builds. Microsoft has published an official advisory and released patches to address this issue. The vulnerability has a CVSS 3.1 base score of 8.4, indicating high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. However, there are no reports of active exploitation in the wild.

An official fix is available from Microsoft. Users and administrators should apply the latest security updates as provided in the Microsoft Security Response Center advisory. Since this is a cloud-hosted service, Microsoft manages remediation for the cloud environment. Check the vendor advisory for the most current patch and update guidance.