CVE-2026-47635: Microsoft Office 2024 Heap Overflow Remote Code Execution

Technical summary

CVE-2026-47635 is a heap-based buffer overflow (CWE-122) in Microsoft Office 2024. The vulnerability stems from improper memory management when processing specific input, enabling an attacker to overflow a heap buffer and overwrite adjacent memory structures. This memory corruption can be leveraged to achieve arbitrary code execution in the context of the Office application. The attack vector is local, requires no user interaction, and no special privileges—meaning any user with command-line or local file access can potentially trigger the vulnerability without social engineering.

Business impact

This vulnerability poses a significant local privilege escalation and lateral movement risk. An attacker who compromises a user account or gains temporary local access could execute malicious code with the privileges of the Office process. In enterprise environments, this creates a pathway for ransomware deployment, data exfiltration, and persistence mechanisms. Organizations relying on Office for business-critical workflows face operational disruption and potential compliance violations if data is compromised. The ease of exploitation (no user interaction required) makes this a priority remediation target.

Affected systems

Microsoft Office 2024 is confirmed vulnerable. Organizations running this version across Windows environments should assume all instances are at risk. Legacy or non-standard Office deployments should be verified against the vendor's official compatibility matrix to confirm scope. Users on earlier Office versions (2019, 2021, subscription variants) should consult Microsoft's security advisory to determine if patches are applicable to their specific builds.

Exploitability

The vulnerability has a high exploitability profile: local access is required, but no authentication or user interaction is needed. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N) reflects this. An attacker with shell access, physical access to an unlocked machine, or the ability to execute files through a prior compromise can trigger the overflow. The barrier to exploitation is low for anyone already inside the security perimeter. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, but this does not indicate the absence of active exploitation attempts.

Remediation

Apply the security update released by Microsoft for Office 2024 as soon as operationally feasible. Patch deployment should be prioritized for machines handling sensitive data, administrative workstations, and systems exposed to untrusted users. Complementary controls include restricting local access through host-based firewalls, disabling unnecessary Office macros and plugins, and enforcing endpoint detection and response (EDR) tools to monitor for suspicious Office process behavior. For environments unable to patch immediately, consider disabling or isolating the most frequently exploited Office features if business operations allow.

Patch guidance

Consult Microsoft's official security advisory for CVE-2026-47635 to obtain the specific patch version and deployment timeline. Microsoft typically releases patches on monthly Patch Tuesday cycles; verify the exact update KB number and whether it applies to your Office deployment model (MSI, Click-to-Run, Microsoft 365 subscription). Test patches in a non-production environment first, especially in environments with custom Office add-ins or legacy integrations. Enable automatic updates where possible to reduce time-to-patch for future vulnerabilities.

Detection guidance

Monitor for heap corruption crashes or anomalous termination of Office processes (WINWORD.exe, EXCEL.exe, POWERPNT.exe, etc.). EDR and security analytics platforms should alert on suspicious Office child processes, especially those spawning command shells or writing to system directories. Heap spray techniques or unusual memory access patterns may be visible in kernel-level telemetry. Network-based detection is limited for this local vulnerability, but monitor for post-exploitation command-and-control traffic that may follow successful code execution. Correlate Office crashes with file activity to identify suspicious document or input sources.

Why prioritize this

This vulnerability merits immediate remediation due to its CVSS 8.4 severity, local code execution impact, and low barrier to exploitation. The absence of user interaction and privilege requirements makes it exploitable by a broad category of attackers, including disgruntled insiders and threat actors who have gained initial access. The ubiquity of Office in enterprise environments amplifies risk. Although not yet in the KEV catalog, the combination of ease-of-exploitation and high impact suggests active exploitation attempts are plausible. Organizations should treat this as a tier-one patch priority.

Risk score, explained

The CVSS 3.1 score of 8.4 (HIGH) reflects a vulnerability with local attack vector, low attack complexity, no privilege or user interaction requirements, and unrestricted confidentiality, integrity, and availability impact. While the attack vector is local rather than network-based (which would elevate the score further), the complete absence of exploitation barriers—coupled with Office's pervasive deployment—justifies rapid remediation. The HIGH severity correctly signals a critical business risk in most enterprise contexts.

Frequently asked questions