Executive brief
Microsoft Office contains a heap-based buffer overflow vulnerability that allows attackers to execute arbitrary code on affected systems over the network. An attacker could exploit this flaw to gain unauthorized access to sensitive documents and data, install malware, or compromise business operations without requiring user interaction or valid credentials.
Technical details
A heap-based buffer overflow exists in Microsoft Office that can be exploited over the network to achieve remote code execution. The vulnerability stems from improper bounds checking in memory allocation, allowing an attacker to write data beyond allocated heap buffers. The attack vector is network-based with no authentication or user interaction required. A successful exploit would grant the attacker the ability to execute arbitrary code with the privileges of the Office application. Patch availability status is unknown from the provided references; consult Microsoft Security Response Center for current remediation guidance.
Affected products
- Microsoft Office
Timeline
- 2026-09-08: disclosed