CVE-2026-78510

Think of Microsoft Word as a doorway into your computer. This flaw is like a crack in the door where a bad actor can potentially slip in and make the computer run their code remotely. If you’re using affected Office/Word versions, installing the Microsoft fix is the best way to close that crack.

This matters if you use Microsoft Word as part of Microsoft 365 Apps / Microsoft Office (including the Office LTSC for Mac 2021/2024 and Microsoft Office 2016/2019/2021/2024 lines listed). The risk is tied to having a vulnerable Word build in place; exploitation requires an attacker to reach and trigger the vulnerable behavior through network-facing access paths. Based on the findings provided, no public exploit code is currently on record, but you should still treat this as urgent because it’s a remote code execution issue in widely used software.

Verdict: RED. Attackers are actively targeting this class of high-impact Office remote code execution flaws, and this one is covered by Microsoft patch guidance for affected Word installations. Even though no public exploit code is on record and it’s not listed in CISA KEV, the impact (remote code execution) is severe enough that you should prioritize updating immediately.

1. Identify your exact Office/Word version

   • Open any affected Microsoft Office app (Word is the key) and check “About” to record the version/build.
   • Confirm which product line you’re on: Microsoft 365 Apps vs Microsoft Office vs the Mac LTSC 2021/2024 variants.

2. Determine whether you’re before the fixed versions

   • If you have Microsoft 365 Apps, the fix is: 16.0.20326.20138 (apply if your build is older).
   • If you have Microsoft Office, apply the Microsoft-provided fixed build for your update branch; the findings list fixed versions including: 16.0.5569.1000, 16.0.10417.20207, 16.0.14334.20906, 16.0.17932.20976.
   • Use Microsoft’s update guide for CVE-2026-78510 to confirm the correct branch mapping for your environment.

3. Upgrade/apply the patch

   • Use your normal Microsoft update mechanism (Microsoft 365 update channels / Office update policy / Mac update process) to move to the fixed build(s) above.
   • Restart Office after patching.

4. Validate

   • Re-check “About” in Word to confirm you’re now on a fixed build.
   • If you manage multiple devices, repeat validation per device.

5. Temporary workaround if patching is delayed

   • Reduce exposure to remote entry points that could be used to reach vulnerable clients (for example, tighten network access rules and review any services that allow remote delivery of documents).
   • If your business relies on opening untrusted documents, temporarily increase controls around inbound email attachments and externally shared files until updates are deployed.

6. What to monitor

   • After updating, review endpoint detections and logs for unusual Word/Office child-process activity, crashes, or new executables originating from Office activity.

Note: KEV was not listed in CISA KEV and no public exploit code was found in the provided findings; this does not lower the priority because the vulnerability is high-impact and Microsoft has published fixes.

CVE-2026-78510 is a Microsoft Word remote code execution vulnerability attributed to CWE-122 (heap-based buffer overflow). The weakness allows an unauthorized attacker to execute code over a network against affected Microsoft Office/Microsoft 365 desktop installations. The provided findings do not list the issue in CISA KEV and report no public exploit code on record; exploitation maturity appears limited by those signals, but the overall severity is high and Microsoft has shipped fixed builds. Patch availability is confirmed via Microsoft’s update guide, with fixed versions published for Microsoft 365 Apps and multiple Microsoft Office branches. EPSS is reported as predicted likelihood (1.0% with a flat trend), but this should not be used to down-rank urgency given the RED verdict and confirmed availability of fixes.