CVE-2026-108449
published 2026-10-15CVE-2026-108449: Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
PriorityP354high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.43%
36.5th percentile
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_365_apps_for_enterprise | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_365_for_mac | >= 1.0.0 < 16.114.26101123 | 16.114.26101123 |
| microsoft | microsoft_office_ltsc_2021 | >= 16.0.1 < 16.0.14334.20974 | 16.0.14334.20974 |
| microsoft | microsoft_office_ltsc_2024 | >= 16.0.0 < 16.0.17932.21056 | 16.0.17932.21056 |
| microsoft | microsoft_office_ltsc_for_mac_2021 | >= 16.0.1 < 16.114.26101123 | 16.114.26101123 |
| microsoft | microsoft_office_ltsc_for_mac_2024 | >= 16.0.0 < 16.114.26101123 | 16.114.26101123 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
ghsa_unreviewed·2026-10-15
CVE-2026-108449 [HIGH] CWE-122 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
VulDB
Microsoft 365 Apps for Enterprise buffer overflow
vuldb·2026-10-15·CVSS 8.8
CVE-2026-108449 [HIGH] Microsoft 365 Apps for Enterprise buffer overflow
A vulnerability categorized as critical has been discovered in Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC and Office LTSC for Mac. The affected element is an unknown function. Such manipulation leads to buffer overflow.
This vulnerability is uniquely identified as CVE-2026-108449. The attack can be launched remotely. No exploit exists.
It is advisable to implement a patch to correct this issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-15
Published