Advisory · CVE-2026-108440
Stack overflow in Word document parsing can run code on Windows and Mac
A stack-based buffer overflow in Microsoft Word enables code execution through a crafted document on the listed Windows and Mac builds. Microsoft rates it CVSS 3.1 8.8.
- Vendor
- Microsoft
- Product
- Microsoft Word
- Identifier / CWE
- CVE-2026-108440
CWE-121 - Action timing
- Immediate
Explain it like I’m five
An oversized piece of document data is copied onto a fixed stack area and overwrites the program's return path.
- 01Crafted document delivered
An attacker sends a malicious Office file by email, chat, or a download link.
- 02User opens the file
The victim opens the file in Microsoft Word, reaching the vulnerable parsing code.
- 03Memory flaw trips
The stack-based buffer overflow corrupts memory handling inside the application.
- 04Attacker code runs
Code executes in the context of the user who opened the document.
What happened
Microsoft disclosed CVE-2026-108440 in its October 2026 security release: a stack-based buffer overflow (CWE-121) in Microsoft Word. An unauthenticated attacker needs a user to open a crafted file; the flaw then runs code in that user’s context. Microsoft rates it CVSS 3.1 8.8.
The vendor record lists as affected: Microsoft 365 Apps for Enterprise, Office LTSC 2021 (before 16.0.14334.20974) and Office LTSC 2024 (before 16.0.17932.21056), plus the Mac builds listed in the vendor record (before 16.114.26101123). Use the MSRC bulletin for the exact build table for your channel.
What to do
- Inventory Microsoft 365 Apps, Office LTSC 2021 and LTSC 2024 installs, including Mac builds where the vendor record lists them.
- Apply the October 2026 Microsoft security updates so builds reach at least the fixed thresholds in the MSRC bulletin linked above.
- Treat unsolicited Office documents as hostile until patching lands: block or detonate attachments at the mail gateway where possible.
- Hunt endpoint telemetry for Office processes spawning shells, script hosts, or unexpected child processes around document opens.
- Verify the installed build number after updating, not just that an update ran.
Management note
Office document parsing remains one of the most reliable initial-access paths into enterprises. An 8.8 that only needs a document open belongs on the fast patch ring, ahead of routine monthly cadence.