CVE-2026-80085
Status: AnalyzedHigh (8.8)—
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Base score: 8.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.82%
- Percentile among all scored CVEs: 56
- Score date: 10/5/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
🎯 ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1203Exploitation for Client Executionexecution85 % - Primary impact
T1059Command and Scripting Interpreterexecution80 %
Vector CVSS con UI:R (interacción del usuario) indica ejecución en cliente al abrir documento Word preparado. Heap overflow permite ejecución arbitraria de código.
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
🛡️ ATT&CK mitigations that cover these techniques
Affected technologies (6)
CWEs
- CWE-122
References
Raw JSON (NVD)
Show
{
"id": "CVE-2026-80085",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-80085",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-09-09T04:22:49.266509Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "secure@microsoft.com",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Microsoft 365 Apps for Enterprise",
"versions": [
{
"status": "affected",
"version": "16.0.1",
"lessThan": "16.0.20326.20138",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Office 2019",
"versions": [
{
"status": "affected",
"version": "19.0.0",
"lessThan": "16.0.10417.20207",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Office 365 for Mac",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "16.113.26091433",
"versionType": "custom"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Office LTSC 2021",
"versions": [
{
"status": "affected",
"version": "16.0.1",
"lessThan": "16.0.14334.20906",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Office LTSC 2024",
"versions": [
{
"status": "affected",
"version": "16.0.0",
"lessThan": "16.0.17932.20976",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Office LTSC for Mac 2021",
"versions": [
{
"status": "affected",
"version": "16.0.1",
"lessThan": "16.113.26091433",
"versionType": "custom"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Office LTSC for Mac 2024",
"versions": [
{
"status": "affected",
"version": "16.0.0",
"lessThan": "16.113.26091433",
"versionType": "custom"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Word 2016",
"versions": [
{
"status": "affected",
"version": "16.0.1",
"lessThan": "16.0.5569.1000",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
}
]
}
],
"published": "2026-09-08T18:20:50.870",
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80085",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "secure@microsoft.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"description": [
{
"lang": "en",
"value": "CWE-122"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network."
}
],
"lastModified": "2026-09-17T20:18:35.263",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378"
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*",
"vulnerable": true,
"matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF"
},
{
"criteria": "cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "12418BDE-FA2E-4BBF-8E47-45C505399898"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "241CDE2B-ABD0-4EFF-8D73-1766E32FA20F"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x86:*",
"vulnerable": true,
"matchCriteriaId": "14D63E3F-A431-4DD8-979F-811E8DAC423D"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*",
"vulnerable": true,
"matchCriteriaId": "1D518075-3362-4D15-93B1-0E6C61518D16"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*",
"vulnerable": true,
"matchCriteriaId": "1059BEC6-C30B-4F0F-A878-5267A21CBD85"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*",
"vulnerable": true,
"matchCriteriaId": "0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*",
"vulnerable": true,
"matchCriteriaId": "55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*",
"vulnerable": true,
"matchCriteriaId": "8887D177-26A3-4008-89B6-50A9E9830F13"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*",
"vulnerable": true,
"matchCriteriaId": "589B470B-9C2E-41E2-A44D-D8CCB4D2F933"
},
{
"criteria": "cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "E1FE9E95-4874-46EF-AC93-9E485F7A2AC0"
},
{
"criteria": "cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:x86:*",
"vulnerable": true,
"matchCriteriaId": "38479B5D-66F9-4260-A18A-F6E3D9B6991E"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secure@microsoft.com"
}