Executive brief
Microsoft Office is a widely used productivity suite for document creation and editing. A heap-based buffer overflow vulnerability allows an attacker to execute arbitrary code with the privileges of the user running Office, potentially leading to data theft, system compromise, or malware installation.
Technical details
A heap-based buffer overflow vulnerability exists in Microsoft Office, triggered when processing specially crafted input. The vulnerability allows an attacker to overflow a heap buffer, enabling arbitrary code execution in the context of the affected Office process. Local execution is required; this is not a remote code execution vulnerability. An attacker must craft a malicious document or input that, when processed by Office, triggers the overflow. Microsoft has released or is preparing patches to address this issue.
Affected products
- Microsoft Office
Timeline
- 2026-08-11: disclosed