CVE-2026-81952

This vulnerability is a bug in Microsoft Word that can be triggered by opening a specially created document. If someone sends you a malicious Word file, the flaw can let that file cause Word to run code on the device. Think of it like a “crash-proof” door that can be forced open with the right key—only here the “key” is a crafted document.

This matters if you use any of the following in your business: Microsoft 365 Apps, Microsoft Office, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft 365, Office 2016, Office 2019, Office 2021, or Office 2024. The risk is tied to document opening, meaning an attacker needs a user to open a crafted file. Based on the provided findings, there is no confirmed exploitation in the wild for this specific CVE, but it still becomes a real risk when a malicious document is reachable to staff via email or other file sharing.

This should be treated as urgent because the flaw is a remote code execution issue in Microsoft Word, meaning a malicious document can directly lead to code running on a user’s device. Even though the provided findings do not show confirmed exploitation for CVE-2026-81952, it remains high-impact software used widely in small businesses, and patch guidance is available.

Confirm whether you’re affected

• Identify which Office/Word product and version your organization uses (Windows vs. Mac, and whether it’s Microsoft 365 Apps vs. Microsoft Office vs. Office LTSC).
• For each device, check the installed Word build/version.
  • If your build is earlier than the Microsoft fixed version(s) listed below for your product, you’re likely exposed.

Upgrade to the fixed versions

Patch to the Microsoft-provided versions:

• Microsoft 365 Apps → 16.0.20326.20138
• Microsoft Office → fixed in one of these builds: 16.0.5569.1003, 16.0.10417.20207, 16.0.14334.20906, 16.0.17932.20976

Because the fixed Microsoft Office versions are listed as multiple specific build numbers, apply the one that matches your product’s servicing channel/stream.

Temporary workaround (if patching is delayed)

• Treat external document attachments as risky: tighten email/file policies so staff are alerted and discouraged from opening unexpected Word documents.
• Ensure your standard email security and attachment scanning is enabled and configured to quarantine or block suspicious Office files.

What to monitor

• After updating, confirm users can open normal documents and verify Office/Word update status remains current.
• Review security logs for unusual application behavior around times Word was used to open email attachments (only if you already have monitoring in place).

Exploitation status note

• The provided findings state that no incidents were reported and there is no clear dated claim of exploitation in the wild for CVE-2026-81952, and no public exploit code is on record.

CVE-2026-81952 is an RCE vulnerability in Microsoft Word tied to CWE-122 (heap-based buffer overflow). The mechanism described is a memory corruption that can be triggered by opening a specially crafted document delivered over a network. The provided findings do not indicate confirmed exploitation in the wild (no KEV listing and no dated news claim for this CVE), and there is no public exploit code on record. Patch guidance is available from Microsoft for multiple Microsoft Office servicing lines.

KEV status: not listed.
Exploit maturity in the provided findings: no public exploit code and no incident reports provided.
Predicted likelihood (EPSS): provided as a prediction with a flat trend, but it should not be treated as evidence of active exploitation.