CVE-2026-78510 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Office installations, especially those exposed to untrusted networks, should assess their exposure and prioritize patching.

Why it matters

Defenders should prioritize patching vulnerable Microsoft Office installations, especially those exposed to untrusted networks, due to the critical nature of this vulnerability and potential for remote code execution.

• Potential remote code execution
• Network exploitation possible without user interaction
• Requires patching of vulnerable Microsoft Office installations
• Verification of applied updates necessary

Technical summary

A heap-based buffer overflow vulnerability exists in Microsoft Office Word, allowing an unauthorized attacker to execute code over a network. The vulnerability has a CVSS score of 9.8 and is considered critical. It can be exploited remotely without user interaction, and defenders should prioritize patching vulnerable Microsoft Office installations, especially those exposed to untrusted networks. The vulnerability affects Microsoft Office Word and can be mitigated by applying updates for Microsoft 365 Apps, Office 2016, Office 2019, Office 2021, and Office 2024.

Defensive priority

Defenders should prioritize patching vulnerable Microsoft Office installations, especially those exposed to untrusted networks.

Recommended defensive actions

• Patch vulnerable Microsoft Office installations
• Verify and apply updates for Microsoft 365 Apps, Office 2016, Office 2019, Office 2021, and Office 2024
• Review network exposure for Microsoft Office installations

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify which versions are affected or provide additional details on exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.