EUVD-2026-102454Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Word document via phishing
-
DeliveryVictim opens file in Office Word
-
ExploitTrigger use-after-free in parser
-
ExecutionCorrupt memory and hijack control flow
-
ImpactExecute arbitrary code as the user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted document in Microsoft Office Word (UI:R) - this is the primary limiting factor; it cannot be triggered purely remotely without user action. No authentication is required (PR:N) and no special non-default configuration is indicated. Affected deployments include Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and the macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024); both Windows and Mac Office users are in scope. Code executes with the privileges of the user who opened the document, so least-privilege user accounts and Protected View / blocking documents from untrusted sources meaningfully reduce impact. |
| Impact | This is a genuine high-priority patching target, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-deliverable, low-complexity, unauthenticated code-execution flaw whose single mitigating factor is required user interaction (UI:R) - i.e. the victim must open a malicious Word document. CWE-416 (use-after-free) memory-corruption bugs in Office parsers are historically reliable to weaponize and are a favored phishing payload. However, the exploitation signals are currently muted: no EPSS score, KEV status, POC availability, or SSVC decision data was provided in the input, so there is no evidence of active exploitation or public exploit code at this time. The risk is therefore driven by the high intrinsic severity and the enormous install base rather than by observed in-the-wild activity. One data note: AV:N is Microsoft's standard classification for document-opened Office flaws (the file arrives over the network), but actual exploitation is effectively local/client-side and gated by UI:R - do not read AV:N as remote serverside exploitation. |
| Exploit ScenarioDerived | An attacker emails or otherwise delivers a crafted Word document to a target and uses social engineering to get it opened. When Office Word parses the malicious file, a use-after-free condition is triggered that corrupts memory and allows the attacker to execute arbitrary code in the context of the user. No public exploit code or active exploitation was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Use-after-free memory corruption in Microsoft Office Word enables remote attackers to execute arbitrary code with the privileges of the user who opens a maliciously crafted document. The flaw is unauthenticated (PR:N) but requires the victim to open the document (UI:R), and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); vendor patches are available, making this a genuine high-priority patching target rather than an emergency.
RemediationAI
Apply the vendor-supplied fix via the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108442 - patch availability is confirmed by Microsoft, so update Microsoft 365 Apps for Enterprise, Office 365 for Mac, and Office LTSC 2021/2024 (including the Mac LTSC editions) to the most recent supported builds through Microsoft Update, Windows Update for Business, Microsoft AutoUpdate on macOS, or your standard servicing channel; because no exact build number is published in the available data, rely on the MSRC advisory for the precise fixed build per product rather than assuming an incremental patch level. Until systems are updated, reduce exposure by enforcing Protected View and disabling editing of files originating from the internet or untrusted locations, enabling Microsoft Defender Application Guard for Office, deploying Attack Surface Reduction rules that block Office from creating child processes, and opening documents only from trusted senders. Additional compensating controls include running Office under least-privilege user accounts (code executes at the user's privilege level, so standard users limit blast radius), stripping or quarantining unsolicited attachments at the mail gateway, and blocking Office file types from untrusted network shares; note that Protected View and ASR rules can interfere with legitimate macro-driven or automation workflows, so test these controls against business-critical documents before broad rollout.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free), a memory-safety defect in the Word document parsing/rendering path. The application frees a heap object but continues to reference it, letting an attacker influence heap layout and reclaim the freed chunk with attacker-controlled data; the resulting type confusion/corrupted pointer can be leveraged into arbitrary code execution. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a network-deliverable attack that needs no credentials or special configuration, but does require user interaction - the victim must open the crafted file. Scope is unchanged (S:U), so code runs in the security context of the opening user rather than elevating beyond it; consequently least-privilege accounts, Protected View, and blocking documents from untrusted sources materially reduce impact. Affected builds span Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Office LTSC 2021 and 2024, and Office LTSC for Mac 2021/2024, i.e. the same memory-corruption surface exists on both Windows and macOS Office clients.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious document is delivered over the network (AV:N) but requires the user to open it (UI:R); no privileges needed (PR:N), and a use-after-free yielding code execution gives full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Word users across Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 on Windows and macOS face a high-severity code-execution risk when opening a crafted document, with any compromise running under the user's own privileges and potentially exposing sensitive data or connected systems. Because no public exploit identified at time of analysis and vendor patches are available, leadership should prioritize rapid patch deployment for affected productivity endpoints rather than treat this as an active incident, while protecting high-risk users until remediation is complete.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
GitHub PoC
Exploit-DB