CVE-2026-69285 – Microsoft Office Remote Code Execution Vulnerability

CVE-2026-69285 is a Critical remote code execution vulnerability in affected Microsoft Office products caused by a heap-based buffer overflow. An unauthorized attacker can exploit the vulnerability by convincing a user to open a specially crafted file. Successful exploitation could allow attacker-controlled code to execute, with high potential impact to confidentiality, integrity, and availability. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no attacker privileges. User interaction is required because the targeted user must open a specially crafted file. Successful exploitation can result in remote code execution and high confidentiality, integrity, and availability impact.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-69285 is a heap-based buffer overflow (CWE-122) affecting Microsoft Office. The vulnerability can occur when a user opens a specially crafted file supplied by an attacker. The attack vector is network-based, attack complexity is low, and no privileges are required, although user interaction is necessary. Successful exploitation can allow an unauthorized attacker to execute code and potentially compromise the confidentiality, integrity, and availability of the affected system.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2016 and 2019 (32-bit and 64-bit), and Microsoft Office LTSC 2021 and 2024 (32-bit and 64-bit). Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run on affected systems, creating significant risks to sensitive information, system integrity, and business operations. Because Office applications are widely used to handle business documents, a malicious file could provide an effective path for compromising targeted endpoints.

WORKAROUND: No workaround or mitigation is identified. An official fix is identified as the remediation.

URGENCY: This vulnerability carries a Critical severity rating and a CVSS base score of 8.8. Its low attack complexity and lack of required attacker privileges increase the potential exposure, although exploitation still requires a user to open a malicious file. Organizations using affected Microsoft Office products should prioritize deployment of the official fix.