KB5002859 — Security Update for Microsoft Office 2016

Overview

KB5002859 is a critical security update for Microsoft Office 2016 released on April 14, 2026. This update addresses multiple high-severity vulnerabilities that could allow remote code execution, information disclosure, privilege escalation, and denial of service attacks against systems running Office 2016.

Security Vulnerabilities Addressed

This update resolves several critical security vulnerabilities across Office 2016 components:

Remote Code Execution Vulnerabilities

Multiple remote code execution vulnerabilities have been identified in Office 2016's document processing engines. These vulnerabilities could allow attackers to execute arbitrary code by convincing users to open specially crafted Office documents. The vulnerabilities affect:

• Microsoft Word 2016 document parsing engine
• Microsoft Excel 2016 formula calculation system
• Microsoft PowerPoint 2016 slide rendering components
• Shared Office graphics processing libraries

Information Disclosure Vulnerabilities

Information disclosure vulnerabilities in Office 2016 could allow attackers to read sensitive information from system memory. These vulnerabilities primarily affect Excel's calculation engine and could expose data from other applications or documents loaded in memory.

Elevation of Privilege Vulnerabilities

Local privilege escalation vulnerabilities in Office 2016 could allow attackers with limited user access to gain elevated permissions on the system. These vulnerabilities affect PowerPoint's rendering engine and shared Office components.

Denial of Service Vulnerabilities

Denial of service vulnerabilities could allow attackers to cause Office applications to crash or become unresponsive by providing malformed input. These vulnerabilities primarily affect Outlook's message processing and could impact email functionality.

Affected Systems

This security update applies to the following Microsoft Office 2016 configurations:

Operating System Compatibility

The update is compatible with the following operating systems:

• Windows 10 version 1607 (Anniversary Update) and later
• Windows 11 (all versions)
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022

Installation and Deployment

Automatic Installation

For most users, KB5002859 will be automatically installed through Microsoft Update. The update is classified as Important and will be installed during the next scheduled update cycle for systems with automatic updates enabled.

Manual Installation

Enterprise administrators can download the update manually from the Microsoft Update Catalog for deployment through Windows Server Update Services (WSUS), System Center Configuration Manager (SCCM), or Microsoft Intune.

Click-to-Run Installations

For Office 2016 Click-to-Run installations, the update is delivered through the Office update mechanism. Users can manually trigger updates by navigating to File > Account > Update Options > Update Now in any Office application.

Verification of Installation

To verify successful installation of KB5002859:

1. Open any Office 2016 application
2. Navigate to File > Account
3. Click About [Application Name]
4. Verify the build number includes the security update

Alternatively, use PowerShell to check installed updates:

Get-HotFix -Id KB5002859

Security Impact Assessment

The vulnerabilities addressed by KB5002859 are rated as Critical to Important severity levels. Organizations should prioritize deployment of this update due to the potential for remote code execution attacks through commonly used Office document formats.

Attack Vectors

The primary attack vectors for these vulnerabilities include:

• Email attachments containing malicious Office documents
• Documents downloaded from untrusted websites
• Documents shared through file sharing services
• Documents embedded in web pages or other applications

Mitigation Strategies

While installing KB5002859 is the primary mitigation, organizations can implement additional protective measures:

• Enable Protected View for documents from untrusted sources
• Configure macro security settings to disable macros by default
• Implement application whitelisting to prevent unauthorized code execution
• Deploy endpoint detection and response (EDR) solutions
• Educate users about the risks of opening untrusted documents

Post-Installation Considerations

Performance Impact

The security enhancements in KB5002859 may result in slight performance impacts during document opening and processing. These impacts are typically minimal and should not significantly affect normal Office usage patterns.

Compatibility Testing

Organizations should test the update in non-production environments before widespread deployment, particularly if using:

• Custom Office add-ins or extensions
• Third-party document management systems
• Automated document processing workflows
• Legacy Office macros or VBA applications

Rollback Procedures

If issues occur after installation, the update can be uninstalled through:

• Windows Update history in Settings
• Programs and Features in Control Panel
• PowerShell using the Remove-WindowsUpdate cmdlet