Microsoft Office Word numeric truncation error enables remote code execution

Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

• Microsoft 365 Apps for Enterprise: The affected branch is recorded as starting at 16.0.1 and below the boundary identified in Microsoft's Office Security Releases guidance. The record does not provide a fixed numeric build for that boundary. The scope includes 32-bit and 64-bit systems.
• Microsoft Office LTSC 2021: Versions from 16.0.1 through less than 16.0.14334.20974 are affected. Microsoft records 16.0.14334.20974 as the fixed release for both 32-bit and 64-bit editions.
• Microsoft Office LTSC 2024: Versions from 16.0.0 through less than 16.0.17932.21056 are affected. Microsoft records 16.0.17932.21056 as the fixed release for both 32-bit and 64-bit editions.

The status of other Microsoft Office branches or products is not established by this record.

Microsoft classifies the issue as CWE-197: Numeric Truncation Error and also associates it with CWE-122: Heap-based Buffer Overflow. Numeric truncation can cause a value to be represented or validated incorrectly; the additional heap-based buffer overflow classification indicates a possible memory-safety consequence, but the available evidence does not identify the exact conversion, allocation, copy operation, parser, or function involved. The confirmed reachability is over a network, with no attacker privileges required, low attack complexity, and user interaction required. The record does not identify the attacker-controlled field or file structure, whether a specific Word document type is involved, or whether exploitation escapes application isolation. The affected scope covers the listed 32-bit and 64-bit Office branches.

The recorded reachability is network based. The attack conditions are no privileges required, low complexity, and required user interaction. The supplied record sets public_exploit to false and leaves known_exploited unspecified; therefore, the available evidence does not confirm a working public exploit or a specific exploitation campaign, but it should not be interpreted as proof that exploitation has never occurred. No exploit steps, payload, or campaign-specific indicators are provided.

Successful exploitation could result in remote code execution in the Word process and could affect the confidentiality, integrity, or availability of data or services accessible to that process. The attack does not require prior privileges, but it does require user interaction; the record does not define that interaction more precisely. Scope is recorded as unchanged, so the available evidence does not establish impact beyond the affected security authority. Consequences such as data access, data modification, or service disruption are possible, but no specific breach or lateral-movement outcome is documented.

Successful exploitation could allow code to run with the privileges of the affected Office process. Because the recorded impacts include confidentiality, integrity, and availability, a successful attack could expose or modify information accessible to that process or disrupt the relevant user or service context. The user-interaction requirement reduces the likelihood of fully automated exploitation but does not remove the risk from attacks that can induce the required interaction. The available evidence does not identify a specific breach, victim, or campaign.

1. Prioritize Microsoft's security updates for each affected branch and verify the installed version after deployment.
2. For Microsoft Office LTSC 2021, update to at least 16.0.14334.20974.
3. For Microsoft Office LTSC 2024, update to at least 16.0.17932.21056.
4. For Microsoft 365 Apps for Enterprise, use Microsoft's Office Security Releases guidance to identify the security build applicable to the deployment channel because the available evidence does not provide a fixed numeric build in the record.
5. Microsoft states that the issue was addressed by updates released in October 2026 and notes that the CVE was inadvertently omitted from the October 2026 Security Updates. Customers that already installed the October 2026 updates do not need further action for this issue according to Microsoft's note.
6. Do not assume that the fix for LTSC 2021, LTSC 2024, or Microsoft 365 Apps for Enterprise covers other branches that have not been verified.

1. Inventory systems running Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, or Microsoft Office LTSC 2024, including both 32-bit and 64-bit editions.
2. Check the installed Word version and compare it with the boundaries listed in affected_summary. For Microsoft 365 Apps for Enterprise, use Microsoft's Office Security Releases guidance because the record does not provide a fixed numeric build boundary.
3. Verify deployment of the applicable security update on each product branch instead of assuming that a fix for one branch covers every other branch.
4. As a precaution, review endpoint telemetry for anomalous Office process behavior around suspicious user interactions. This is generic monitoring, not a vendor-confirmed indicator for this issue.
5. Do not treat the absence of suspicious log activity as proof of safety; the available evidence does not provide a specific IOC.