CVE-2026-78507 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office Word deployments should assess exposure and apply patches. System administrators and security teams should verify system configurations and monitor for suspicious activity.

Why it matters

CVE-2026-78507 is a high-severity vulnerability in Microsoft Office Word that requires immediate attention from defenders. The vulnerability allows unauthorized code execution over a network, which can lead to data breaches, system compromise, and disruption of business operations. Defenders should assess exposure, apply patches, and monitor for suspicious activity to prevent potential attacks.

• Potential code execution over a network
• Unauthorized access to sensitive data
• Disruption of business operations
• Need for patching and verification of system configurations

Technical summary

CVE-2026-78507 is a use-after-free vulnerability in Microsoft Office Word that allows an unauthorized attacker to execute code over a network. The vulnerability has a CVSS score of 8.8 and is considered HIGH severity. Affected products include Microsoft 365 Apps, Office 2019, Office 2021, and Office 2024.

Defensive priority

High priority for Microsoft Office Word users to apply patches and verify system exposure.

Recommended defensive actions

• Apply patches from Microsoft for affected Office versions
• Verify system exposure and update vulnerable configurations
• Monitor network traffic for suspicious activity

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but specific version information and exploitation details are limited. The vulnerability affects Microsoft Office Word and has a CVSS score of 8.8. The CVE record was published on 2026-09-08T18:20:45.750Z and has not been modified since then. Defenders should verify system configurations and monitor for suspicious activity. The official CVE Program record and NVD detail page offer additional information. Microsoft's

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.