CVE-2026-77504 – Microsoft Office Word Remote Code Execution Vulnerability

CVE-2026-77504 is a Critical remote code execution vulnerability caused by a double-free weakness (CWE-415) in Microsoft Office Word. An unauthorized attacker can exploit the vulnerability over a network by convincing a user to open a specially crafted file. No privileges are required, but user interaction is required. The affected Microsoft product is identified as Microsoft Office Word; however, the affected-software table lists Windows versions rather than specific Office Word versions, so affected Word versions cannot be confirmed.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker could use a specially crafted file to trigger remote code execution through Microsoft Office Word. Successful exploitation has a High impact on confidentiality, integrity, and availability. The attack complexity is Low and no attacker privileges are required, although a user must open the malicious file.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-77504 results from a double-free memory-management weakness in Microsoft Office Word. A double free occurs when allocated memory is freed more than once, potentially causing memory corruption. In this case, an unauthorized remote attacker can prepare a specially crafted file and persuade a user to open it. Triggering the vulnerability can allow remote code execution. The CVSS metrics identify a Network attack vector, Low attack complexity, no privileges required, required user interaction, unchanged scope, and High confidentiality, integrity, and availability impacts.

EXPLOITABILITY: The source identifies Microsoft Office Word as the affected product but does not identify specific affected Word versions. The affected-software table lists Windows 10, Windows 11, and Windows Server releases from Windows Server 2012 through Windows Server 2025. Exploitation requires the target user to open a specially crafted attacker-controlled file.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution and lead to significant loss of data confidentiality, integrity, and system availability. For organizations, a malicious document could create a path to system compromise, unauthorized changes, data exposure, or operational disruption.

WORKAROUND: No workaround or mitigation is specified. An official fix is identified, so affected systems should be updated through the applicable security update.

URGENCY: This vulnerability carries a Critical severity rating and a CVSS base score of 8.8. Although it is not currently reported as exploited or publicly disclosed, the combination of remote code execution, Low attack complexity, no required privileges, and High impact across confidentiality, integrity, and availability makes timely deployment important.