CVE-2026-77504 – Microsoft Office Word Remote Code Execution Vulnerability
CVSS 8.8
IMPORTANT
Critical - Same Day Deployment
“A malicious Word file could turn one user action into remote code execution, putting the confidentiality, integrity, and availability of affected systems at risk.”
CVE-2026-77504 is a Critical remote code execution vulnerability caused by a double-free weakness (CWE-415) in Microsoft Office Word. An unauthorized attacker can exploit the vulnerability over a network by convincing a user to open a specially crafted file. No privileges are required, but user interaction is required. The affected Microsoft product is identified as Microsoft Office Word; however, the affected-software table lists Windows versions rather than specific Office Word versions, so affected Word versions cannot be confirmed.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- CWE Classification
- CWE-415
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.