Heap-based buffer overflow in Microsoft Office for macOS and Microsoft Office - CVE-2026-108441

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code in the user's context.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing a specially crafted document using the Phonetic Guide feature. A remote attacker can send such a document and convince a user to open it in Microsoft Word and use the Phonetic Guide feature to execute arbitrary code in the user's context.

The Preview Pane is not an attack vector for this vulnerability.

Affected software

How to mitigate CVE-2026-108441

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108441
• https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office