365Fanatic / M365 Status / Security advisories / CVE-2026-78521

Microsoft Security Update Guide · Office / Microsoft 365 Apps

Microsoft Office Word Remote Code Execution Vulnerability

Microsoft · EN CVE-2026-78521 Important Action required CVSS 8.8 Updated

Published 8 sep 2026 · updated 17 sep 2026

Summary Detailed Security

What does this mean?

Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited over the network (including from the internet if the service is reachable there), without an account and if a user takes part, for example by opening a link or file.
CVSS 8.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Word 2016 (64-bit edition): KB5002923 16.0.5569.1000
- Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.113.26091433
- Microsoft Word 2016 (32-bit edition): KB5002923 16.0.5569.1000
- Microsoft Office LTSC 2021 for 32-bit editions: KBRelease Notes 16.0.14334.20906
- Microsoft Office LTSC 2024 for 64-bit editions: KBRelease Notes 16.0.17932.20976
- Microsoft Office LTSC 2024 for 32-bit editions: KBRelease Notes 16.0.17932.20976

Microsoft Office Word · Remote Code Execution

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Office / Microsoft 365 Apps

How do I check if I am affected?

Update the app

Update the app through the App Store, Google Play or the app's own automatic updates.
If you manage devices with Intune, check in the Intune admin center which devices still run an older version.

What kind of flaw is this?

CWE-122: Heap-based Buffer Overflow
A heap buffer overflows, which can lead to running code.

Key facts

Released

8 sep 2026

Last revised

17 sep 2026 (v2)

Impact

Remote Code Execution

Max severity

Important

Weakness

CWE-122: Heap-based Buffer Overflow

CVSS 3.1

8.8 / 7.7 (base / temporal)

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Publicly disclosed

Exploited

Exploitability assessment

Exploitation Less Likely

Customer action required

Yes

Links

Microsoft Security Update Guide · CVE.org

CVSS metrics

Base score metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	Required
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High
Temporal score metrics
Exploit Code Maturity	Unproven
Remediation Level	Official Fix
Report Confidence	Confirmed

Affected products and updates

Product	Update	Build
Microsoft Word 2016 (64-bit edition)	KB5002923 · Security Update	`16.0.5569.1000`
Microsoft Office LTSC for Mac 2024	KBRelease Notes · Security Update	`16.113.26091433`
Microsoft Word 2016 (32-bit edition)	KB5002923 · Security Update	`16.0.5569.1000`
Microsoft Office LTSC 2021 for 32-bit editions	KBRelease Notes	`16.0.14334.20906`
Microsoft Office LTSC 2024 for 64-bit editions	KBRelease Notes	`16.0.17932.20976`
Microsoft Office LTSC 2024 for 32-bit editions	KBRelease Notes	`16.0.17932.20976`
Microsoft Office LTSC 2021 for 64-bit editions	KBRelease Notes	`16.0.14334.20906`
Microsoft Office LTSC for Mac 2021	KBRelease Notes · Security Update	`16.113.26091433`
Microsoft 365 Apps for Enterprise for 64-bit Systems	KBRelease Notes	`16.0.20326.20138`
Microsoft 365 Apps for Enterprise for 32-bit Systems	KBRelease Notes	`16.0.20326.20138`
Microsoft Office 2019 for 32-bit editions	KBRelease Notes	`16.0.10417.20207`
Microsoft Office 2019 for 64-bit editions	KBRelease Notes	`16.0.10417.20207`
Microsoft Office 365 for Mac	KBRelease Notes · Security Update	`16.113.26091433`

FAQ

How could an attacker exploit this vulnerability?: An attacker could send a specially crafted Word document containing malicious mail-merge data to a target user. The user would need to open the document and process or update the mail-merge data. Successful exploitation could allow the attacker to execute code on the user's system. Authentication is not required.
Is the Preview Pane an attack vector for this vulnerability?: No, the Preview Pane is not an attack vector.
Are the updates for Microsoft Office LTSC for Mac 2021 and 2024 currently available?: Yes. As of September 16, 2026, the security update for Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac are available. Customers running Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac should ensure the update is installed to be protected from this vulnerability.

Revisions

Version	Date	Note
2	17 sep 2026	Microsoft is announcing the availability of the security updates for Microsoft Office for Mac. Customers running affected Mac software should install the update for their product to be protected from this vulnerability. Customers running other Microsoft Office software do not need to take any action. See the Release Notes for more information and download links.
1	8 sep 2026	Information published.

This is in the weekly digest for week 38 · What changed this week? →

View at Microsoft → ← All security advisories

Source: Microsoft Security Update Guide. 365Fanatic is not affiliated with Microsoft.