Advisory · CVE-2026-108432
Word heap overflow in October batch spans Windows and Mac Office builds
A heap-based buffer overflow in Microsoft Word allows code execution through a malicious document across the listed Windows and Mac Office builds. Microsoft rates it CVSS 3.1 8.8.
- Vendor
- Microsoft
- Product
- Microsoft Word
- Identifier / CWE
- CVE-2026-108432
CWE-122 - Action timing
- Immediate
Explain it like I’m five
A malformed document section overruns its heap allocation in Word on either platform, and the corruption becomes code execution.
- 01Crafted document delivered
An attacker sends a malicious Office file by email, chat, or a download link.
- 02User opens the file
The victim opens the file in Microsoft Word, reaching the vulnerable parsing code.
- 03Memory flaw trips
The heap-based buffer overflow corrupts memory handling inside the application.
- 04Attacker code runs
Code executes in the context of the user who opened the document.
What happened
Microsoft disclosed CVE-2026-108432 in its October 2026 security release: a heap-based buffer overflow (CWE-122) in Microsoft Word. An unauthenticated attacker needs a user to open a crafted file; the flaw then runs code in that user’s context. Microsoft rates it CVSS 3.1 8.8.
The vendor record lists as affected: Microsoft 365 Apps for Enterprise, Office LTSC 2021 (before 16.0.14334.20974) and Office LTSC 2024 (before 16.0.17932.21056), plus the Mac builds listed in the vendor record (before 16.114.26101123). Use the MSRC bulletin for the exact build table for your channel.
What to do
- Inventory Microsoft 365 Apps, Office LTSC 2021 and LTSC 2024 installs, including Mac builds where the vendor record lists them.
- Apply the October 2026 Microsoft security updates so builds reach at least the fixed thresholds in the MSRC bulletin linked above.
- Treat unsolicited Office documents as hostile until patching lands: block or detonate attachments at the mail gateway where possible.
- Hunt endpoint telemetry for Office processes spawning shells, script hosts, or unexpected child processes around document opens.
- Verify the installed build number after updating, not just that an update ran.
Management note
Office document parsing remains one of the most reliable initial-access paths into enterprises. An 8.8 that only needs a document open belongs on the fast patch ring, ahead of routine monthly cadence.