CVE-2026-88186: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-88186) involves a heap-based buffer overflow in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. It enables remote code execution by an unauthorized attacker over a network. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud service. The affected versions include =16.0.1, =1.0.0, >=16.0.1 <16.0.14334.20974, >=16.0.0 <16.0.17932.21056, and =16.0.0.

Successful exploitation allows remote code execution with high impact on confidentiality, integrity, and availability of the affected system. This could enable an attacker to run arbitrary code in the context of the user running Microsoft Office Word. No known active exploits have been reported.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise installations are updated to the fixed versions as per the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88186.