rootpwn

critical · CVSS v3 8.8

CVE-2026-108450

A heap-based buffer overflow in Microsoft Office Word can be triggered by a crafted document over the network, allowing an attacker to execu

Overview

A heap-based buffer overflow in Microsoft Office Word can be triggered by a crafted document over the network, allowing an attacker to execute arbitrary code. This vulnerability is critical and can compromise confidentiality, integrity, and availability of affected systems. It is exploitable without user interaction, making it a high-priority risk for organizations using Word.

Description

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Impact

Confidentiality: attacker can read or exfiltrate data. Integrity: attacker can modify documents or system settings. Availability: attacker can crash Word or the host system. The vulnerability impacts all users of Microsoft Office Word on Windows platforms, especially those who open documents from untrusted sources over the network.

Remediation

Apply the latest Microsoft security update that patches CVE-2026-108450. Disable automatic document opening from network shares, enforce strict macro policies, and use application whitelisting. Ensure Office is updated to the latest service pack and that network file sharing is secured.

Risk context

Severity is critical with a CVSS score of 8.8, indicating a high likelihood of exploitation. No EPSS data available, but the critical rating warrants immediate patching.

Affected products

  • Microsoft Office Word
  • Microsoft Office 365
  • Microsoft Office 2019
  • Microsoft Office 2016
  • Microsoft Office 2013

Scores

Severity
critical
CVSS v2
10
CVSS v3
8.8
CVSS v4
—
EPSS
—

buffer-overflow office-word critical network-exploit confidentiality integrity availability patch

← All CVEs

Related CVEs

critical

CVE-2026-108442

Microsoft Office Word contains a use‑after‑free vulnerability that can be triggered over a network, enabling an attacker to execute arbitrary code. The flaw is critical and can compromise any system running affected Word versions. It is a high‑risk threat for organizations that rely on Office for document processing.

View analysis

critical

CVE-2026-108443

An off‑by‑one bug in Microsoft Office Word can be triggered over a network, enabling an attacker to execute arbitrary code. The flaw exists in the document parsing logic and can be exploited remotely without user interaction. It poses a critical threat to any environment running vulnerable Word versions.

View analysis

critical

CVE-2026-108444

A heap-based buffer overflow in Microsoft Office can be triggered over a network, allowing an attacker to execute arbitrary code. The flaw exists in multiple Office versions and can be exploited by unauthenticated users. It poses a significant threat to organizations using Office on networked environments.

View analysis

critical

CVE-2026-108445

Microsoft Office Word has a stack-based buffer overflow that can be triggered via a crafted document over a network. An attacker can execute arbitrary code without user interaction. This flaw is critical and can compromise any system running vulnerable Word versions.

View analysis