Microsoft clarifies Office Word RCE CVE-2026-108450 was fixed in October 2026 updates

What happened

Microsoft issued an informational publication for CVE-2026-108450, a remote code execution issue in Microsoft Office Word. The company stated that the vulnerability was corrected in updates released in October 2026, but the CVE identifier was mistakenly omitted from the October 2026 Security Updates summary.

Impact

The affected component is Microsoft Office Word. The source does not provide a severity score, affected version range, or evidence of active exploitation. The key operational point is that the fix was already delivered with the October 2026 update cycle; the publication is a documentation correction rather than a new patch.

What to do

• Confirm that Microsoft Office Word is running the October 2026 update level or later.
• If the October 2026 Office updates are already installed, no further remediation is required for this CVE.
• Record the CVE in vulnerability management tools as patched where the October 2026 update is present, to avoid duplicate ticketing.
• Continue standard Office patching and endpoint monitoring; no special containment action is indicated by the source material.

Editor note

For SecOps teams, treat this as a patch-verification item: confirm the October 2026 Office update state, then close the item if the environment is already current.