What is the CVSS score of CVE-2026-26113?

CVE-2026-26113 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of 365 Apps are affected by CVE-2026-26113?

A critical vulnerability in Microsoft Office allows attackers to execute malicious code on affected systems through untrusted pointer dereference.. A patch is available.

How to fix or mitigate CVE-2026-26113?

Within 24 hours: inventory all Office installations across the organization and restrict access to Office applications where possible; communicate vulnerability details to end-users with guidance to avoid opening untrusted documents. Within 7 days: implement network segmentation to isolate critical systems, disable potentially vulnerable Office features (macros, embedded objects), and deploy endpoint detection and response (EDR) tools to monitor for exploitation attempts. Within 30 days: monitor vendor communication channels for patch availability and establish an expedited patching schedule; conduct user awareness training on document handling best practices.

365 Apps CVE-2026-26113

HIGH

Untrusted Pointer Dereference (CWE-822)

2026-03-10 secure@microsoft.com

Authentication Bypass Microsoft 365 Apps Office Office Long Term Servicing Channel Sharepoint Server

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 8.4

DescriptionCVE.org

Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Unsafe pointer dereference in Microsoft Office, SharePoint Server, and 365 Apps enables local code execution with high privileges on affected systems. An attacker with local access can exploit this memory safety flaw to achieve complete system compromise including data theft and modification. No patch is currently available, leaving users vulnerable until Microsoft releases a security update.