Critical Microsoft Office Vulnerability Enables Remote Code Execution Attacks
On Tue, Mar 10, 2026, Microsoft released critical security updates to address a vulnerability in its Office suite.
On Tue, Mar 10, 2026, Microsoft released critical security updates to address a vulnerability in its Office suite.
Identified as CVE-2026-26110 , this flaw enables unauthorized execution of malicious code on affected devices.
With a CVSS score of 8.4, this vulnerability impacts Microsoft Office applications on Windows, Mac, and Android platforms .
The issue is a "Type Confusion" (CWE-843) weakness, where a resource is accessed with an incompatible type, causing logical errors and out-of-bounds memory accesses .
Exploit of this flaw can bypass software restrictions, access unintended memory regions, and execute unauthorized commands.
On Tue, Mar 10, 2026, Microsoft released critical security updates to address a vulnerability in its Office suite.
Microsoft Office Vulnerability Enables RCE Attack
This vulnerability is classified as a "Remote Code Execution" (RCE) vulnerability. However, the code must be executed locally.
Exploitation requires execution from a local machine, either by an attacker or inadvertently by a victim, a method known as Arbitrary Code Execution (ACE) .
The vulnerability features low attack complexity and requires no elevated privileges or user interaction.
The Windows Preview Pane can be used as an attack vector, allowing compromise without opening a malicious document.
While exploit code has not been proven, Microsoft reports no active exploitation, and future exploitation is considered "less likely."
Microsoft Office 2016 and 2019 (32-bit and 64-bit) Microsoft 365 Apps for Enterprise (32-bit and 64-bit) Microsoft Office LTSC 2021 and 2024 (Windows and Mac) Microsoft Office for Android
Apply Official Updates: Install the Mar 10, 2026, security patches for Office installations. Update Mobile Apps: Ensure updates for the Microsoft Office for Android app from the Google Play Store. Disable the Preview Pane: Temporarily disable the File Explorer Preview Pane in Windows if patching is delayed.
Based on reporting by Cyber Security News.