CVE-2026-96996: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

CVE-2026-96996 is a heap-based buffer overflow vulnerability (CWE-122) in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability requires local access and user interaction to trigger. Microsoft has published an official fix and manages remediation for this cloud service. The CVSS v3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability with low attack complexity and no privileges required.

Successful exploitation allows an attacker to execute arbitrary code locally, compromising system confidentiality, integrity, and availability. The vulnerability requires user interaction but no privileges, making it a significant local threat. There are no reports of active exploitation in the wild.

An official fix is available from Microsoft. Users and administrators should apply the provided security updates as detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96996. Since this is a cloud-hosted service, Microsoft manages remediation server-side. No additional mitigation actions are required beyond applying the official fix.