CVE-2026-78505 – Microsoft Office Remote Code Execution Vulnerability

CVE-2026-78505 is a heap-based buffer overflow vulnerability in Microsoft Office that can allow an unauthorized attacker to execute code in the context of the user. An attacker can convince a user to open and save a specially crafted Microsoft Office document, and the Preview Pane is also identified as an attack vector. Authentication and prior privileges are not required, although successful exploitation requires user interaction.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: Successful exploitation can provide an attacker with remote code execution in the context of the affected user. The vulnerability has low attack complexity, requires no privileges, and can result in high impact to confidentiality, integrity, and availability. A specially crafted Office document is used in the exploitation scenario.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as less likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-78505 is caused by a heap-based buffer overflow in Microsoft Office. The vulnerability can be reached over a network using a specially crafted Office document. An attacker could convince a user to open and save the malicious document, resulting in code execution in the user’s context. The Microsoft Office Preview Pane is also an attack vector. Attack complexity is low, authentication and privileges are not required, but user interaction is required. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Exploitation requires user interaction with a specially crafted Office document. No privileges are required.

BUSINESS IMPACT: Successful exploitation could allow malicious code to run with the affected user’s permissions, threatening sensitive information, data integrity, and system availability. In organizations where Office documents are routinely exchanged, a malicious document could create a significant security risk if users interact with it.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, so affected Microsoft Office installations should be updated.

URGENCY: This patch should be prioritized because the vulnerability is rated Critical and enables remote code execution with low attack complexity and no privileges required. Although exploitation is currently assessed as less likely and no active exploitation is identified, interaction with a specially crafted Office document can lead to high confidentiality, integrity, and availability impact.