All vulnerabilities
CVE-2026-70096

Microsoft 365 Apps for Enterprise: Windows Rich Text Edit Control Remote Code Execution Vulnerability

Microsoft Microsoft 365 Apps for EnterpriseApplications & CMS
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.96%Chance of exploitation activity in the next 30 days, higher than 61% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in16.114.26101123Also 16.0.14334.20974, 16.0.17932.21056 and 13 moreCVE List
Published13 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 16.114.26101123Microsoft Office 365 for MacCVE List
  • 16.0.14334.20974Microsoft Office LTSC 2021CVE List
  • 16.0.17932.21056Microsoft Office LTSC 2024CVE List
  • 16.114.26101123Microsoft Office LTSC for Mac 2021CVE List
  • 16.114.26101123Microsoft Office LTSC for Mac 2024CVE List
  • 10.0.14393.9612Windows 10 Version 1607CVE List
Show all 26 fixed versions
  • 10.0.17763.9376Windows 10 Version 1809CVE List
  • 10.0.19044.7807Windows 10 Version 21H2CVE List
  • 10.0.19045.7807Windows 10 Version 22H2CVE List
  • 10.0.22631.7652Windows 11 version 23H2CVE List
  • 10.0.22631.7652Windows 11 Version 23H2CVE List
  • 10.0.26100.9711Windows 11 Version 24H2CVE List
  • 10.0.26200.9711Windows 11 Version 25H2CVE List
  • 10.0.28000.3231Windows 11 version 26H1CVE List
  • 10.0.26300.9711Windows 11 Version 26H2CVE List
  • 6.2.9200.26434Windows Server 2012CVE List
  • 6.2.9200.26434Windows Server 2012 (Server Core installation)CVE List
  • 6.3.9600.23470Windows Server 2012 R2CVE List
  • 6.3.9600.23470Windows Server 2012 R2 (Server Core installation)CVE List
  • 10.0.14393.9612Windows Server 2016CVE List
  • 10.0.14393.9612Windows Server 2016 (Server Core installation)CVE List
  • 10.0.17763.9376Windows Server 2019CVE List
  • 10.0.17763.9376Windows Server 2019 (Server Core installation)CVE List
  • 10.0.20348.5761Windows Server 2022CVE List
  • 10.0.26100.33650Windows Server 2025CVE List
  • 10.0.26100.33650Windows Server 2025 (Server Core installation)CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Vendor and government advisories 1

Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network.

Text from CVE List

Affected versions 27

  • Microsoft 365 Apps for Enterpriseaffected: 16.0.1 before https://aka.ms/OfficeSecurityReleasesCVE List
  • Microsoft Office 365 for Macaffected: 1.0.0 before 16.114.26101123CVE List
  • Microsoft Office LTSC 2021affected: 16.0.1 before 16.0.14334.20974CVE List
  • Microsoft Office LTSC 2024affected: 16.0.0 before 16.0.17932.21056CVE List
  • Microsoft Office LTSC for Mac 2021affected: 16.0.1 before 16.114.26101123CVE List
  • Microsoft Office LTSC for Mac 2024affected: 16.0.0 before 16.114.26101123CVE List
  • Windows 10 Version 1607affected: 10.0.14393.0 before 10.0.14393.9612CVE List
  • Windows 10 Version 1809affected: 10.0.17763.0 before 10.0.17763.9376CVE List
  • Windows 10 Version 21H2affected: 10.0.19044.0 before 10.0.19044.7807CVE List
  • Windows 10 Version 22H2affected: 10.0.19045.0 before 10.0.19045.7807CVE List
  • Windows 11 version 23H2affected: 10.0.22631.0 before 10.0.22631.7652CVE List
  • Windows 11 Version 23H2affected: 10.0.22631.0 before 10.0.22631.7652CVE List
  • Windows 11 Version 24H2affected: 10.0.26100.0 before 10.0.26100.9711CVE List
  • Windows 11 Version 25H2affected: 10.0.26200.0 before 10.0.26200.9711CVE List
  • Windows 11 version 26H1affected: 10.0.28000.0 before 10.0.28000.3231CVE List
  • Windows 11 Version 26H2affected: 10.0.26300.0 before 10.0.26300.9711CVE List
  • Windows Server 2012affected: 6.2.9200.0 before 6.2.9200.26434CVE List
  • Windows Server 2012 (Server Core installation)affected: 6.2.9200.0 before 6.2.9200.26434CVE List
  • Windows Server 2012 R2affected: 6.3.9600.0 before 6.3.9600.23470CVE List
  • Windows Server 2012 R2 (Server Core installation)affected: 6.3.9600.0 before 6.3.9600.23470CVE List
  • Windows Server 2016affected: 10.0.14393.0 before 10.0.14393.9612CVE List
  • Windows Server 2016 (Server Core installation)affected: 10.0.14393.0 before 10.0.14393.9612CVE List
  • Windows Server 2019affected: 10.0.17763.0 before 10.0.17763.9376CVE List
  • Windows Server 2019 (Server Core installation)affected: 10.0.17763.0 before 10.0.17763.9376CVE List
  • Windows Server 2022affected: 10.0.20348.0 before 10.0.20348.5761CVE List
  • Windows Server 2025affected: 10.0.26100.0 before 10.0.26100.33650CVE List
  • Windows Server 2025 (Server Core installation)affected: 10.0.26100.0 before 10.0.26100.33650CVE List

References 1