CVE-2026-78512: CWE-197: Numeric Truncation Error in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-78512 is a numeric truncation error (CWE-197) in Microsoft Office Word that enables remote code execution by an unauthorized attacker over a network. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise prior to certain build numbers. The CVSS 3.1 base score is 8.8, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected Microsoft 365 Apps for Enterprise environment.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the provided updates as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78512. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Check the vendor advisory for confirmation of patch deployment status.