Advisory · CVE-2026-108427
Second heap overflow in Microsoft Word in the October release runs code from a crafted document
A heap-based buffer overflow in Microsoft Word, tracked separately from its sibling October Word flaws, lets an attacker execute code via a crafted document. Microsoft rates it CVSS 3.1 8.8.
- Vendor
- Microsoft
- Product
- Microsoft Word
- Identifier / CWE
- CVE-2026-108427
CWE-20, CWE-122 - Action timing
- Immediate
Explain it like I’m five
Another document-parsing path in Word trusts size information it should not, and the overflow hands the attacker control of execution.
- 01Crafted document delivered
An attacker sends a malicious Office file by email, chat, or a download link.
- 02User opens the file
The victim opens the file in Microsoft Word, reaching the vulnerable parsing code.
- 03Memory flaw trips
The heap-based buffer overflow corrupts memory handling inside the application.
- 04Attacker code runs
Code executes in the context of the user who opened the document.
What happened
Microsoft disclosed CVE-2026-108427 in its October 2026 security release: a heap-based buffer overflow (CWE-20, CWE-122) in Microsoft Word. An unauthenticated attacker needs a user to open a crafted file; the flaw then runs code in that user’s context. Microsoft rates it CVSS 3.1 8.8.
The vendor record lists as affected: Microsoft 365 Apps for Enterprise, Office LTSC 2021 (before 16.0.14334.20974) and Office LTSC 2024 (before 16.0.17932.21056). Use the MSRC bulletin for the exact build table for your channel.
What to do
- Inventory Microsoft 365 Apps, Office LTSC 2021 and LTSC 2024 installs, including Mac builds where the vendor record lists them.
- Apply the October 2026 Microsoft security updates so builds reach at least the fixed thresholds in the MSRC bulletin linked above.
- Treat unsolicited Office documents as hostile until patching lands: block or detonate attachments at the mail gateway where possible.
- Hunt endpoint telemetry for Office processes spawning shells, script hosts, or unexpected child processes around document opens.
- Verify the installed build number after updating, not just that an update ran.
Management note
Office document parsing remains one of the most reliable initial-access paths into enterprises. An 8.8 that only needs a document open belongs on the fast patch ring, ahead of routine monthly cadence.