CVE-2026-88185: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88185) involves a heap-based buffer overflow in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. An attacker can exploit this flaw remotely without privileges or user interaction to execute arbitrary code. The vulnerability is tracked under CWE-122. The CVSS v3.1 score is 8.1, indicating high impact on confidentiality, integrity, and availability. Microsoft has published an official security update to address this issue.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected environment. No known exploits are currently observed in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Microsoft 365 Apps for Enterprise as soon as possible. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components; however, on-premises or client installations must be updated manually. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88185 for detailed patching instructions.