CVE-2026-108428: Microsoft Office Word Remote Code Execution Vulnerability

For administrators, that distinction matters: this is a document-opening risk, not a preview-triggered attack. Updating affected Office installations remains the required response.

What the Word vulnerability allows​

According to Microsoft’s advisory, a heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. The weakness is classified as CWE-122.

The advisory clarifies how the network attack vector relates to the user’s actions: an attacker must persuade a user to open a specially crafted file to initiate remote code execution. The network designation does not mean this vulnerability can be triggered without user interaction.

Microsoft supplies the following assessment:

Publicly disclosed: No
Exploited: No
Customer action required: Yes

The complete CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

The vector describes a network attack vector (AV:N), low attack complexity, no required privileges, and required user interaction (UI:R). It assigns high potential impact to confidentiality, integrity, and availability, with unchanged scope.

“Exploitation Less Likely” is Microsoft’s assessment, not a reason to leave affected systems unpatched. Likewise, the exploitation and disclosure statuses describe the advisory’s assessment rather than a guarantee about future attacks.

Affected products and fixed-build mappings​

Microsoft’s affected-product information covers both listed architectures of Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.

For Microsoft 365 Apps for Enterprise, the vendor’s fixed-build value points to its Office security releases resource. Administrators should use that release information to select the applicable update rather than treating the reference as a numerical build.

Microsoft’s remediation values are reproduced below, with the release reference shown as literal text:

For Microsoft 365 Apps for Enterprise for 32-bit Systems (x86), update to fixed build [Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn](https://aka.ms/OfficeSecurityReleases) or later.
For Microsoft 365 Apps for Enterprise for 64-bit Systems (x64), update to fixed build [Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn](https://aka.ms/OfficeSecurityReleases) or later.
For Microsoft Office LTSC 2021 for 32-bit editions (x86), update to fixed build 16.0.14334.20974 or later.
For Microsoft Office LTSC 2021 for 64-bit editions (x64), update to fixed build 16.0.14334.20974 or later.
For Microsoft Office LTSC 2024 for 32-bit editions (x86), update to fixed build 16.0.17932.21056 or later.
For Microsoft Office LTSC 2024 for 64-bit editions (x64), update to fixed build 16.0.17932.21056 or later.

Practical implications for patch deployment​

The mappings support an important operational comparison: both architectures share the same fixed build within each listed LTSC release, but LTSC 2021 and LTSC 2024 have different build targets. A compliance check should therefore match the Office product release to its corresponding fix, rather than apply one numerical threshold across the entire estate.

A focused response is to:

1. Identify affected installations by product and architecture. Include both 32-bit and 64-bit Office deployments.
2. Deploy the corresponding Office update. Use the listed LTSC target or Microsoft’s Office security release information for Microsoft 365 Apps for Enterprise.
3. Verify the installed build after deployment. Success means the installation meets the applicable product’s fixed-build requirement, not merely that an update was scheduled.
4. Reinforce caution around unexpected files while updates roll out. This follows directly from the advisory’s requirement that a user open the attacker’s crafted file.

Disabling the Preview Pane would not address the attack path Microsoft describes: the Preview Pane is explicitly outside this vulnerability’s attack vectors. The practical priority is to update the affected Office products and verify the result, while reducing opportunities for users to open untrusted documents.