CVE-2026-78505

This vulnerability is in Microsoft Office’s handling of certain document content. An attacker can hide a “payload” inside a malicious file so that, when someone opens it, Office can be tricked into running attacker code. In the real world, that can turn a simple email attachment into a takeover of the machine running Office.

This matters if you use or manage Microsoft Office or Microsoft 365 apps in your business (including the named Mac Office LTSC versions). It’s especially relevant if employees receive email attachments or files from outside your organization. The risk is mainly tied to user interaction—an attacker typically needs to get the malicious document opened by a user.

This is a RED issue because it’s a high-impact remote code execution class vulnerability in widely used business software. Even though no public exploit code is on record and CISA KEV doesn’t list it, you should treat it as a pressing patching problem for any environment running affected Office builds. Update immediately to the fixed Office versions listed by Microsoft.