CVE-2026-78505

This vulnerability is in Microsoft Office’s handling of certain document content. An attacker can hide a “payload” inside a malicious file so that, when someone opens it, Office can be tricked into running attacker code. In the real world, that can turn a simple email attachment into a takeover of the machine running Office.

This matters if you use or manage Microsoft Office or Microsoft 365 apps in your business (including the named Mac Office LTSC versions). It’s especially relevant if employees receive email attachments or files from outside your organization. The risk is mainly tied to user interaction—an attacker typically needs to get the malicious document opened by a user.

This is a RED issue because it’s a high-impact remote code execution class vulnerability in widely used business software. Even though no public exploit code is on record and CISA KEV doesn’t list it, you should treat it as a pressing patching problem for any environment running affected Office builds. Update immediately to the fixed Office versions listed by Microsoft.

1. Inventory what you run

   • Identify the exact Office product and version on each device (Windows: Microsoft 365 apps / Microsoft Office; Mac: Microsoft Office LTSC for Mac 2021 or Microsoft Office LTSC for Mac 2024).

2. Compare against Microsoft’s fixed versions

   • If you have Microsoft 365 apps, ensure it is fixed in 16.0.20326.20138 or later.
   • If you have Microsoft Office (Windows), ensure your installation is at or above one of the fixed builds provided by Microsoft (fixed versions listed include 16.0.5569.1000, 16.0.10417.20207, 16.0.14334.20906, 16.0.17932.20976). Because these are multiple fixed builds, apply the update channel you use and confirm the resulting version meets the fixed build requirement.
   • If you have Microsoft Office LTSC for Mac 2021 or Microsoft Office LTSC for Mac 2024, update to fixed in 16.112.26083020.

3. Apply the update

   • Use your normal enterprise update process (Microsoft 365 update mechanism for Microsoft 365 apps; the LTSC update process for LTSC) and let it fully complete.

4. Post-update verification

   • Re-check the Office “About” / version information to confirm the device is reporting the updated build number.
   • Confirm your Office security settings (for example, how attachments and macros are handled) match your organization’s policy; the patch reduces exposure, but policy helps reduce malicious-file attempts.

5. Temporary containment if patching is delayed

   • Reduce exposure to risky attachments in the meantime: tighten email/file gateway rules and ensure users are prevented from opening untrusted documents.
   • Prioritize updates for devices most likely to open external attachments (sales, admin, leadership).

6. What to monitor

   • Monitor endpoint detections and Office-related alerts after updating.
   • Look for unusual spawned processes or unexpected application behavior following receipt/opening of external Office documents.

CVE-2026-78505 is categorized as CWE-122 (heap-based buffer overflow) in Microsoft Office. The provided description indicates remote attackers can achieve code execution over a network using a crafted Office file, with user interaction implied (the document must be opened). The findings do not report KEV listing, public exploit code availability, or known exploitation indicators; however, the verdict is RED due to the high severity remote code execution impact and broad product reach. Microsoft has published remediation with multiple fixed versions across Microsoft 365 apps, Microsoft Office, and Office LTSC for Mac (2021/2024). No EPSS value is used in public-facing owner guidance, and no KEV/date-driven exploitation confirmation is provided in the findings.