CVE-2026-96995 Microsoft CVE debrief

Who should care

Defenders responsible for managing Microsoft Office installations, especially in environments where local access is common, should assess exposure and apply patches.

Why it matters

CVE-2026-96995 is a high-severity elevation of privilege vulnerability in Microsoft Office Word, allowing authorized attackers to escalate privileges locally via a stack-based buffer overflow. Defenders should prioritize verifying exposure, applying patches, and monitoring systems for potential exposure.

• Verify and prioritize patching of affected Microsoft Office versions to prevent local privilege escalation
• Inventory and monitor systems for potential exposure, especially in local access scenarios
• Assess and implement compensating controls for unpatched systems

Technical summary

A stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally. Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, and various Office LTSC versions. The vulnerability can be exploited locally, potentially allowing attackers to gain elevated privileges. Defenders should prioritize verifying exposure of Microsoft Office installations, especially in local access scenarios, and apply patches from Microsoft.

Defensive priority

Defenders should prioritize verifying exposure of Microsoft Office installations, especially in local access scenarios, and apply patches from Microsoft.

Recommended defensive actions

• Verify and apply Microsoft patches for affected Office versions
• Inventory Office installations for potential exposure
• Monitor local access scenarios for suspicious activity

Evidence notes

The CVE record and source item provide details on the vulnerability, but specific exploitation or impact instances are not mentioned. The vulnerability is a stack-based buffer overflow in Microsoft Office Word, allowing an authorized attacker to elevate privileges locally. There is no mention of known affected scope or specific instances of exploitation. Defenders should verify exposure and apply patches from Microsoft, and review compensating controls for unpatched systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.