CVE-2026-96995: CWE-121: Stack-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-96995) is a stack-based buffer overflow in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. It enables an authorized attacker with local access to escalate privileges on the affected system. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low complexity, and no user interaction required. The vulnerability affects versions including =16.0.0, =16.0.1, >=16.0.0 <16.0.17932.21056, and >=16.0.1 <16.0.14334.20974. Microsoft has issued an official fix for this vulnerability. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96995. No known exploits in the wild have been reported.

An authorized local attacker can exploit this stack-based buffer overflow to elevate privileges, potentially gaining higher-level access on the affected system. This could lead to full compromise of the affected user's privileges and possibly the system, depending on the environment and configuration.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the available patches as soon as possible to remediate the issue. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96995 for detailed patching instructions.