CVE-2026-69285 - Microsoft Office Remote Code Execution Vulnerability · CoreCVE

Back Back to CVE browser

HIGH

Microsoft Office Remote Code Execution Vulnerability

Published Sep 8, 2026

8.8

HIGH

CVSS 3.1

EPSS 0.82%

Description

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.

Affected products

Vendor Microsoft Product Microsoft 365 Apps for Enterprise Default
n/a
- Version
  16.0.1
  Status
  affected
  Constraints
  <16.0.20326.20138
Vendor Microsoft Product Microsoft Office 2016 Default
n/a
- Version
  16.0.0
  Status
  affected
  Constraints
  <16.0.5569.1000
Vendor Microsoft Product Microsoft Office 2019 Default
n/a
- Version
  19.0.0
  Status
  affected
  Constraints
  <16.0.10417.20207
Vendor Microsoft Product Microsoft Office LTSC 2021 Default
n/a
- Version
  16.0.1
  Status
  affected
  Constraints
  <16.0.14334.20906
Vendor Microsoft Product Microsoft Office LTSC 2024 Default
n/a
- Version
  16.0.0
  Status
  affected
  Constraints
  <16.0.17932.20976

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft 365 Apps for Enterprise

n/a

Version	Status	Constraints
16.0.1	affected	<16.0.20326.20138

Microsoft Office 2016

n/a

Version	Status	Constraints
16.0.0	affected	<16.0.5569.1000

Microsoft Office 2019

n/a

Version	Status	Constraints
19.0.0	affected	<16.0.10417.20207

Microsoft Office LTSC 2021

n/a

Version	Status	Constraints
16.0.1	affected	<16.0.14334.20906

Microsoft Office LTSC 2024

n/a

Version	Status	Constraints
16.0.0	affected	<16.0.17932.20976

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-122

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-73287
Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69285
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-73287		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69285		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Sep 8, 2026

Updated Oct 1, 2026

Reserved Aug 3, 2026

Link CVE-2026-69285

CISA Vulnrichment

Updated Sep 9, 2026

Status Analyzed

Modified Sep 9, 2026

Link CVE-2026-69285

Severity n/a

Public date n/a

Links CVE-2026-69285

Assigner microsoft

Published Sep 8, 2026

Updated Oct 1, 2026

Exploited since n/a

Link EUVD-2026-73287

EUVD-2026-73287