CVE-2026-26110 Microsoft CVE debrief

Who should care

Endpoint and desktop engineering teams, Microsoft 365/Office administrators, SOC and vulnerability management teams, and anyone responsible for supported or legacy Office deployments across Windows, macOS, or Android.

Technical summary

The issue is described as an access-of-resource-using-incompatible-type problem (type confusion) in Microsoft Office. According to the supplied NVD data, exploitation can lead to local code execution, and the mapped weakness is CWE-843. The referenced vulnerable CPEs include Microsoft 365 Apps (x64/x86), Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Office for Android prior to version 16.0.19822.20000.

Defensive priority

High. Prioritize patching for systems that run affected Office builds because the flaw can enable local code execution with no privileges or user interaction reflected in the supplied CVSS vector. Focus first on broadly deployed enterprise Office installations and any fleet segments using LTSC or Android Office builds in the NVD scope.

Recommended defensive actions

• Review the Microsoft Security Response Center update guide for CVE-2026-26110 and apply the relevant Office updates as soon as they are available in your servicing channel.
• Inventory affected Microsoft Office installations across Windows, macOS, and Android to identify exposure to the CPE scope listed by NVD.
• Prioritize remediation for Microsoft 365 Apps, Office 2016/2019, and Office LTSC 2021/2024 deployments that match the vulnerable product families in the NVD record.
• If Android Office is in use, verify versions are at or above 16.0.19822.20000, since NVD lists earlier versions as vulnerable.
• Validate patch deployment and watch for unexpected Office process crashes or anomalous local execution activity as part of routine endpoint monitoring.

Evidence notes

This debrief uses only the supplied official sources: the NVD CVE record and Microsoft’s MSRC update guide reference. The CVE was published on 2026-03-10 and last modified on 2026-03-13 per the supplied timeline. The affected product scope is derived from NVD CPE entries, and the weakness mapping is CWE-843 from the vendor/NVD data. No KEV date was supplied, and the enrichment flags indicate no KEV listing in the provided corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.