Heap-based buffer overflow in Microsoft Office Word

CVE-2026-81952 is a heap-based buffer overflow (CWE-122) in the Microsoft Office Word document parser. An attacker crafts a malicious .docx or .doc file; when a user opens it in an affected version of Word, the parser overflows a heap buffer, giving the attacker arbitrary code execution in the context of the logged-in user. Affected builds span Office LTSC 2021 (before 16.0.14334.20906), Office 2019 (before 16.0.10417.20207), Microsoft 365 Apps (before 16.0.20326.20138), and standalone Word 2016 (before 16.0.5569.1003). The fix shipped in the September 8, 2026 Patch Tuesday alongside ~110 other Office patches, 22 of which were Critical.

Microsoft rates this HIGH at 8.8 — and the raw CVSS math is defensible: network-delivered, low complexity, no auth required, full CIA impact. But the vector includes UI:R (user must open the document), and modern Office opens internet- and email-sourced files in Protected View (a sandboxed read-only mode) by default. There is no confirmation that this CVE fires from the Outlook Preview Pane the way some sibling CVEs (e.g., CVE-2026-40361, CVE-2026-78509) do. With no public PoC, no KEV listing, and an EPSS of 0.6%, the real-world urgency is meaningfully lower than the CVSS label implies — but the sheer installed base of Word keeps the floor firmly at HIGH.

Why this verdict

• User interaction gate: The CVSS vector requires UI:R — the victim must open a crafted document. On modern Office with default Group Policy, files from email and the internet open in Protected View first, requiring a second deliberate click to enable editing. This two-step user-action chain reduces real-world exploitability below a zero-click RCE.
• No weaponization evidence: Zero public PoCs, no KEV listing, and EPSS at 0.6%. Heap overflows in complex parsers like Word require significant exploit development effort for reliable code execution (vs. a crash). This is not a script-kiddie-accessible bug today.
• Role multiplier: Word runs on virtually every enterprise endpoint (>90% coverage). On a standard workstation the blast radius is a single user session — HIGH but contained. On an IT admin workstation with cached domain admin credentials or an active PAM session, successful exploitation chains to domain compromise. On a developer workstation with CI/CD tokens or signing keys, it chains to supply-chain impact. Because Word is installed on admin and developer machines by default, the high-value-role fraction is non-trivial (estimated 5-15% of Word installs sit on privileged-user endpoints). This floors the verdict at HIGH.
• Compensating controls are strong but not universal: EDR, ASR rules, email gateway sandboxing, and Protected View all impede this chain — but none are deployed at 100% coverage across a 10,000-host fleet. The friction is real but not absolute.

Why not higher?

This is not CRITICAL because exploitation requires two user actions (open document + click Enable Editing), there is no public exploit code, no KEV listing, and no evidence of in-the-wild exploitation. The September Patch Tuesday included genuinely zero-click Office RCEs (e.g., Preview Pane vectors like CVE-2026-78509) that deserve the CRITICAL label ahead of this one. Word is also not a *canonical* high-value-role component (it's not an IdP, hypervisor, or DC) — it merely *runs on* high-value hosts.

Why not lower?

Word's installed base is essentially fleet-wide in any enterprise, making the exposure population enormous. Heap-based buffer overflows are a proven, weaponizable primitive — not a theoretical DoS. The full CIA impact (C:H/I:H/A:H) means a successful hit gives the attacker complete control of the user session, and on privileged endpoints that translates to domain-scale compromise. MEDIUM would understate the risk for a component this ubiquitous with this impact ceiling.

1. Enforce Attack Surface Reduction (ASR) rules for Office — Enable the ASR rules Block Office applications from creating child processes, Block Win32 API calls from Office macros, and Block Office applications from creating executable content via Intune or Group Policy. These break the post-exploitation chain even if the heap overflow fires. Deploy within 30 days per the noisgate mitigation SLA for HIGH.
2. Lock down Protected View via Group Policy — Set Do not allow users to disable Protected View for files originating from the Internet and equivalent policies for email attachments and unsafe locations. This prevents users from clicking 'Enable Editing' on externally sourced documents, keeping the sandbox gate closed. Deploy within 30 days.
3. Ensure email gateway sandbox detonation is active — Confirm that Microsoft Defender for Office 365 Safe Attachments (or equivalent SEG sandbox like Proofpoint TAP) is enabled in block mode for .doc/.docx attachments. This catches the most common delivery vector before the document reaches the endpoint.
4. Accelerate patch deployment to privileged-user endpoints — Prioritize the September cumulative Office update on IT admin workstations, developer machines, and finance/exec endpoints where credential theft or data exfiltration has outsized impact. Use your existing ring-based deployment but pull these hosts into ring 0.

Run this on each target Windows host (or via your RMM tool) with standard user privileges. Example: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-81952.ps1. It checks the installed Word build number against the patched versions.

#Requires -Version 5.1
<# Check-CVE-2026-81952.ps1
   Checks whether installed Microsoft Word is patched for CVE-2026-81952.
   Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$patchedBuilds = @{
    # Channel/SKU => minimum safe build
    '16.0.20326' = 20138   # Microsoft 365 Apps (Current Channel)
    '16.0.17932' = 20976   # Microsoft 365 Apps (Monthly Enterprise)
    '16.0.14334' = 20906   # Office LTSC 2021
    '16.0.10417' = 20207   # Office 2019
    '16.0.5569'  = 1003    # Office 2016
}

function Get-WordBuild {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration',
        'HKLM:\SOFTWARE\Microsoft\Office\16.0\Common\InstalledPackages'
    )
    # Try ClickToRun first
    $c2r = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' -ErrorAction SilentlyContinue
    if ($c2r -and $c2r.VersionToReport) { return $c2r.VersionToReport }
    # Fallback: find winword.exe
    $winword = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe' -ErrorAction SilentlyContinue
    if ($winword -and $winword.'(default)') {
        $fi = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($winword.'(default)')
        return "$($fi.FileMajorPart).$($fi.FileMinorPart).$($fi.FileBuildPart).$($fi.FilePrivatePart)"
    }
    return $null
}

$version = Get-WordBuild
if (-not $version) {
    Write-Output 'UNKNOWN - Microsoft Word not detected on this host.'
    exit 2
}

Write-Output "Detected Word version: $version"
$parts = $version.Split('.')
if ($parts.Count -lt 4) { Write-Output 'UNKNOWN - Could not parse version.'; exit 2 }

$major = $parts[0]
$minor = $parts[1]
$build = [int]$parts[2]
$rev   = [int]$parts[3]
$prefix = "$major.$minor.$build"

$matched = $false
foreach ($key in $patchedBuilds.Keys) {
    if ($prefix -eq $key) {
        $matched = $true
        if ($rev -ge $patchedBuilds[$key]) {
            Write-Output "PATCHED - Build $version meets or exceeds fix revision $($patchedBuilds[$key]) for prefix $key."
            exit 0
        } else {
            Write-Output "VULNERABLE - Build $version is below fix revision $($patchedBuilds[$key]) for prefix $key. Patch for CVE-2026-81952 is missing."
            exit 1
        }
    }
}

if (-not $matched) {
    # Check if build is higher than all known patched builds (newer channel)
    if ($build -gt 20326) {
        Write-Output "PATCHED - Build $version appears to be a newer channel release beyond known affected ranges."
        exit 0
    }
    Write-Output "UNKNOWN - Build $version does not match known affected version prefixes. Manual verification recommended."
    exit 2
}

Sources

1. THREATINT CVE-2026-81952 Detail
2. Qualys September 2026 Patch Tuesday Review
3. CrowdStrike September 2026 Patch Tuesday Analysis
4. Cybersecurity News - September 2026 Patch Tuesday
5. GBHackers - Microsoft September 2026 Patch Tuesday
6. Automox Patch Tuesday September 2026 CVE Analysis
7. MSRC CVE-2026-69556 (sibling Word RCE reference)