Microsoft Office Word CVE‑2026‑108433 Fix Omitted from Update List – No Action Needed

What happened

Microsoft Office Word had a security feature bypass vulnerability (CVE‑2026‑108433) that could allow an attacker to execute arbitrary code. The issue was fixed in the October 2026 security update, but the CVE was inadvertently omitted from the update’s public advisory.

Impact

All users of Microsoft Office Word who had not yet applied the October 2026 update remain vulnerable. The vulnerability could be triggered by a specially crafted document, potentially leading to code execution.

What to do

• Verify that the October 2026 security update is installed on all Word installations.
• If the update is missing, install it immediately from Windows Update or the Microsoft Update Catalog.
• Consider enabling Office’s "Protected View" and disabling macros for untrusted documents.

Microsoft confirmed that users who have applied the October 2026 updates are already protected and no additional steps are required.