CVE-2026-78510 is a high severity (CVSS 8.4) remote code execution flaw in Microsoft Office. The fix is the September 2026 Microsoft 365 Apps and Office security update. Microsoft has not marked it as exploited at release, and the CISA KEV flag is false. Check the MSRC entry for your exact build.
What's affected
Microsoft Office. The record lists the affected product families, and Microsoft's September 2026 update data lists the specific builds and the update (KB) number for each. Microsoft's data lists the customer action as required, so the fix is a normal security update.
The record lists Microsoft 365 Apps, Microsoft 365, and Office 2016, 2019, 2021 and 2024. Microsoft's data points to its Office update release notes for the build numbers.
Microsoft's data marks the issue as not publicly disclosed and not exploited at release, with an exploitability assessment of Exploitation Less Likely. The record's KEV flag is false. An assessment of this kind can change, so recheck the entry if the issue matters to you.
How to check if you're exposed
Check the build number in any Office app under Account, then compare it with the fixed build in Microsoft's Office security update release notes for your channel.
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" | Select-Object VersionToReport, UpdateChannel
Click-to-Run installs report their build here. MSI-based Office 2016 and 2019 installs update through Windows Update.
What to do now
- Open the Microsoft update guide entry and find the update that applies to your exact build.
- Deploy the September 2026 security update through your normal patch process, test group first, then broad rollout.
- Confirm the update installed on a sample of machines, then report coverage across the fleet.
- Confirm that Office update channels are not paused, and that endpoints that rarely open Office have still updated.
Why it matters
The weakness is CWE-122, heap-based buffer overflow. A heap overflow means data is written past the end of a memory block. In a document application, the input that triggers it is usually a file or message the program parses. The record's attack vector is local, but Microsoft's title names Outlook and Word, which handle files and mail, so treat attachments as the realistic route in.
The published description is a single sentence, and Microsoft does not add technical detail for most of these issues. That is typical, and it is the reason to judge risk by exposure: who can reach the vulnerable component, and how fast you can patch it. The vector is local with no privileges and no user interaction, though Microsoft titles the entry Outlook and Word Remote Code Execution.
Quick check
Why does the record say local if the title says remote code execution?
The vector describes where the attacker must act. A file opened on the machine counts as local, even if it arrived by mail. Microsoft's title names the result.
Is it exploited?
Microsoft's release data says not exploited, and the KEV flag is false.
Sources
Last reviewed: 18 October 2026.
