CVE-2026-97001: CWE-122: Heap-based Buffer Overflow in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-97001) is a heap-based buffer overflow in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute arbitrary code locally by exploiting improper memory handling. The CVSS 3.1 score is 7.8 (high severity) with attack vector local, low attack complexity, no privileges required, but user interaction is needed. The vulnerability affects multiple versions of Microsoft 365 Apps for Enterprise, including =16.0.0, =16.0.1, >=16.0.0 <16.0.17932.21056, and >=16.0.1 <16.0.14334.20974, as well as =1.0.0. Microsoft has issued an official fix for this vulnerability and manages remediation for this cloud-hosted service. No known exploits are reported in the wild.

Successful exploitation allows an unauthorized attacker to execute arbitrary code locally, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability requires local access and user interaction, limiting remote exploitation. No active exploitation in the wild is currently known.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97001. Since this is a cloud service, Microsoft manages remediation server-side. No additional action is required beyond applying the official fix.