CVE-2026-77504

This vulnerability is a weakness in Microsoft Office Word. If someone sends a specially prepared Word document (or otherwise triggers Word processing over the network), it may allow their code to run on your computer instead of just opening the file safely—like slipping a booby-trapped note into a stack of business paperwork.

This matters if your company runs Microsoft Office Word on Windows 10/11 or the listed Windows Server versions. Even if you don’t think you’re a “target,” Word documents are commonly exchanged via email and file sharing, so risk increases wherever untrusted documents can be opened. There is no evidence here that this is actively exploited in the wild (not in CISA KEV), and it is expected to be reachable through the normal ability to trigger Word processing on a machine; exposure depends on whether the affected Office/Word pathway can be reached by an attacker through network-delivered content.

This is RED because it is a remote code execution bug in a widely used application component (Word) with high impact (code can run on the device). While there’s no CISA KEV listing and no public exploit code recorded here, the attacker path is straightforward for phishing/document-based attacks, so you should treat patching as time-critical.

1. Confirm affected systems

   • Inventory endpoints/servers running: Windows 10 or Windows 11 or any of the listed Windows Server versions.
   • Confirm Microsoft Office Word usage on those systems (either installed Office, or Word used via standard Office workflows).
   • Check current Windows build (e.g., “winver” in Windows) for each machine.

2. Determine whether each system is still vulnerable

   • Compare the machine’s build to the fixed builds below (based on its product branch):
     • Windows 10: fixed in 10.0.14393.9512; 10.0.17763.9245; 10.0.19044.7725; 10.0.19045.7725
     • Windows 11: fixed in 10.0.22631.7582; 10.0.26100.9445; 10.0.26200.9445; 10.0.28000.2954
     • Windows Server 2012: fixed in 6.2.9200.26349
     • Windows Server 2012 R2: fixed in 6.3.9600.23397
     • Windows Server 2016: fixed in 10.0.14393.9512
     • Windows Server 2019: fixed in 10.0.17763.9245

3. Patch

   • Apply Microsoft’s update for CVE-2026-77504 using the Microsoft update guide.
   • Reboot after installation if required.

4. Validate

   • After reboot, verify the installed update level/build matches the fixed versions for the relevant branch.
   • Exercise your normal Word document handling paths (opening typical internal files and any email attachment preview workflows) to confirm no operational regressions.

5. If patching is delayed (temporary risk reduction)

   • Prevent untrusted Word documents from being opened automatically (no auto-preview/open actions).
   • Restrict who can open or run Office content from email/file shares, especially from external senders.
   • Increase monitoring for unusual Word/Office child-process activity and unexpected application crashes while you complete patching.

6. What to monitor after patching

   • Endpoint logs for Office/Word errors and suspicious process launches.
   • Microsoft advisories for any change in exploitation status (this issue is not in CISA KEV per the findings).

CVE-2026-77504 is an Office Word remote code execution vulnerability with a memory-management weakness classified as CWE-415. The provided technical description indicates a double free, which is a type of memory-safety bug where freeing the same memory twice can corrupt program state and lead to attacker-controlled behavior. The findings indicate no CISA KEV listing and no public exploit code on record; however, this does not reduce the need to patch because remote code execution is typically attainable via crafted documents that trigger Word’s parsing/execution path. The reported risk/interest is supported by press attention referencing Qualys, and the traffic-light verdict is RED for prioritization. (No public exploitation status confirmation is available in the findings beyond the absence of KEV/exploit code.)