EUVD-2026-22615Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
6DescriptionCVE.org
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AnalysisAI
Use-after-free memory corruption in Microsoft Office Word enables local code execution with high privileges when victims open malicious documents. Affects Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024 for Windows and Mac (versions below 16.108.26041219 for Mac; click-to-run editions require latest security updates). CVSS 7.8 reflects local attack vector requiring user interaction, but exploitation grants complete system compromise (confidentiality, integrity, availability all rated High). No public exploit identified at time of analysis, though use-after-free vulnerabilities are well-understood exploitation primitives. Vendor-released patch available through Microsoft security updates.
Technical ContextAI
This vulnerability stems from CWE-416 (Use After Free), a memory management defect where Microsoft Word's document parsing engine attempts to access heap memory after it has been deallocated. The affected component is the Word file format parser across multiple Microsoft Office product lines: Microsoft 365 Apps for Enterprise (subscription-based Office suite), Office LTSC 2021 and 2024 (perpetual license editions), and their Mac equivalents. Use-after-free conditions arise when object lifetime management fails during complex document parsing operations, leaving dangling pointers that reference freed memory. When an attacker crafts a malicious Word document to control the contents of the freed memory region and triggers the dangling pointer dereference, they can redirect execution flow to attacker-controlled code. The CVSS vector AV:L indicates local attack vector requiring file system access, while UI:R confirms user must open the weaponized document. PR:N means no authentication to the system is required-an unauthenticated user account can trigger the vulnerability. The vulnerability affects Word's core parsing routines used across all listed Office product variants, suggesting shared codebase or library components.
RemediationAI
Apply Microsoft security updates immediately through Windows Update or Microsoft AutoUpdate for Mac to address this vulnerability. For Microsoft Office LTSC for Mac 2021 and 2024, upgrade to version 16.108.26041219 or later which contains the complete fix. For Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024 on Windows (click-to-run deployments), apply the latest security updates from https://aka.ms/OfficeSecurityReleases following Microsoft's standard update channels. Enterprise administrators should deploy updates through Microsoft Endpoint Configuration Manager, Group Policy, or Office Deployment Tool for centralized patch management. Until patching is complete, implement defense-in-depth controls including disabling macros in Office Trust Center settings, enabling Protected View for files from untrusted sources, restricting document execution through application control policies (AppLocker/Windows Defender Application Control), and conducting user awareness training on phishing threats involving weaponized Office documents. Verify successful patch deployment by checking Word version numbers in Help > About or through inventory management systems. Full remediation guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33095.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today