CVE-2026-81952: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-81952) is a heap-based buffer overflow in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. It enables an attacker to execute arbitrary code remotely without privileges, requiring only user interaction. The CVSS 3.1 score is 8.8, reflecting high impact on confidentiality, integrity, and availability. The vendor has published an official fix and manages remediation for this cloud-hosted service. Multiple affected version ranges are identified, all prior to specific fixed builds.

Successful exploitation allows remote code execution with high impact on confidentiality, integrity, and availability of the affected system. The attacker can run arbitrary code in the context of the user, potentially leading to full system compromise. The vulnerability requires user interaction but no privileges or authentication.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81952. Since this is a cloud service, Microsoft manages remediation server-side. No additional mitigation actions are required beyond applying the official fix.