Microsoft 365 Apps For Enterprise CVE-2026-32190

The victim must open a crafted Office document (.docx, .xlsx, .pptx, etc.) sent by the attacker. Requires local access to a Windows system running vulnerable Microsoft Office versions (2016-2021 or Office 365). No special Office features or configurations required — affects default installations.

Real-world risk is constrained by the local attack vector (AV:L) requiring pre-existing system access, though the CVSS 8.4 score reflects critical technical severity due to zero authentication requirements (PR:N), low complexity (AC:L), and no user interaction needed (UI:N). The CVSS vector indicates an attacker who has already gained local access can trivially escalate privileges or execute arbitrary code without any social engineering or timing constraints. However, the local-only attack surface significantly reduces internet-based threat exposure compared to remotely exploitable vulnerabilities. No CISA KEV listing and absence of public exploit code suggest this is not yet observed in active campaigns, reducing immediate urgency despite high CVSS. SSVC analysis would likely classify this as 'Attend' rather than 'Act' given non-remote attack vector and lack of confirmed exploitation automation. The primary concern is enterprise environments where untrusted users have local access to systems running vulnerable Office installations, or post-compromise scenarios where attackers chain this with initial access vulnerabilities for privilege escalation.

An attacker with existing local access to a workstation running vulnerable Microsoft Office opens a specially crafted Office document or triggers the vulnerability through malicious macros or embedded objects. The use-after-free condition allows the attacker to manipulate freed memory regions, redirecting program execution to attacker-controlled code that executes with the privileges of the Office application process. This enables installation of persistent malware, credential theft, or lateral movement within the enterprise network without requiring any victim interaction beyond the initial document access.