Heap-based buffer overflow in Microsoft Office for macOS and Microsoft Office - CVE-2026-108449

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code in the victim user's context.

The vulnerability exists due to a heap-based buffer overflow in Microsoft Office Word when processing a specially crafted document opened and saved in OpenDocument Text format. A remote attacker can send a specially crafted document and convince a user to open it in Microsoft Word and save it in OpenDocument Text format to execute arbitrary code in the user's context.

The Preview Pane is not an attack vector for this vulnerability.

Affected software

How to mitigate CVE-2026-108449

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-108449
• https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office