CVE-2026-81952 – Microsoft Word Remote Code Execution Vulnerability

CVE-2026-81952 is a critical Microsoft Word remote code execution vulnerability caused by a heap-based buffer overflow. An unauthenticated attacker can craft a malicious RTF file that executes arbitrary code in the user’s context when the file is opened or rendered in the Preview Pane. The vulnerability requires no attacker privileges but does require user interaction.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an attacker to execute arbitrary code with the permissions of the affected user. The attack has network reachability, low attack complexity, and requires no privileges. Confidentiality, integrity, and availability impacts are all rated High.

EXPLOITS: This vulnerability was not publicly disclosed and was not known to be exploited at publication. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-81952 is a heap-based buffer overflow (CWE-122) affecting Microsoft Office Word. An unauthenticated attacker can create a specially crafted malicious RTF file designed to trigger the memory corruption condition. Exploitation can occur when a user opens the file or when the file is rendered through the Preview Pane. Successful exploitation allows arbitrary code to execute in the user’s context and can result in high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include 32-bit and 64-bit editions of Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Exploitation requires a user to open a malicious RTF file or have it rendered in the Preview Pane. No attacker privileges are required.

BUSINESS IMPACT: Successful exploitation could allow malicious code to run under the affected user’s permissions, potentially exposing sensitive information, modifying data, or disrupting access to systems and information. Document-based delivery and the Preview Pane attack vector make malicious files particularly significant in environments where Office documents are routinely received and handled.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, making patch deployment the documented remediation.

URGENCY: This Critical vulnerability should be prioritized for patch deployment because it provides remote code execution with low attack complexity and requires no attacker privileges. A malicious RTF file can trigger exploitation when opened or rendered in the Preview Pane, creating a significant risk wherever untrusted Office documents may be processed.