Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-78504: Microsoft Word could let attackers run code remotely

CVE-2026-78504 · published 1 month ago

Summary

Several versions of Microsoft Word, including Office 2019, Office 365 for Mac, and the 2021 and 2024 LTSC releases, have a flaw that could let an outside attacker run malicious programs on a user's computer. This could give the attacker control of the system or access to sensitive data. Install the latest security updates from Microsoft as soon as possible to close the gap.

What to do

Update microsoft microsoft 365 apps for enterprise to version 16.0.20326.20138 or later.
Update microsoft microsoft office 2019 to version 16.0.10417.20207 or later.
Update microsoft microsoft office ltsc 2021 to version 16.0.14334.20906 or later.
Update microsoft microsoft office ltsc 2024 to version 16.0.17932.20976 or later.
Update microsoft microsoft word 2016 to version 16.0.5569.1000 or later.
Update microsoft microsoft office 365 for mac to version 16.113.26091433 or later.
Update microsoft microsoft office ltsc for mac 2021 to version 16.113.26091433 or later.
Update microsoft microsoft office ltsc for mac 2024 to version 16.113.26091433 or later.

Affected software

Vendor	Product	Affected versions
microsoft	microsoft 365 apps for enterprise	< 16.0.20326.20138
microsoft	microsoft office 2019	< 16.0.10417.20207
microsoft	microsoft office 365 for mac	- < 16.113.26091433
microsoft	microsoft office ltsc 2021	< 16.0.14334.20906
microsoft	microsoft office ltsc 2024	< 16.0.17932.20976
microsoft	microsoft office ltsc for mac 2021	- < 16.113.26091433
microsoft	microsoft office ltsc for mac 2024	- < 16.113.26091433
microsoft	microsoft word 2016	< 16.0.5569.1000
microsoft	365_apps	All versions `cpe:2.3:a:microsoft:365_apps:-::::enterprise::x64:*`
microsoft	microsoft_365	All versions `cpe:2.3:a:microsoft:microsoft_365:-:::::macos::`
microsoft	office_2019	All versions `cpe:2.3:a:microsoft:office_2019:-::::::x64:`
microsoft	office_2021	All versions `cpe:2.3:a:microsoft:office_2021:-::::ltsc:-:x64:`
microsoft	office_2024	All versions `cpe:2.3:a:microsoft:office_2024:-::::ltsc:-:x64:`
microsoft	word	2016 `cpe:2.3:a:microsoft:word:2016::::::x64:`

Original advisory text

Microsoft Office Word Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78504 vendor-advisory patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-121Stack-based Buffer Overflow

Timeline

Published8 Sep 2026

Updated4 Nov 2026

First seen8 Sep 2026

Sources

CVE-2026-78504 · NVD

CVE-2026-78504 · MITRE

Track software like this

Free during beta