EUVD-2026-29640
GHSA-4qm9-v478-vh8f
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Use-after-free in a document parser realistically needs the victim to open a crafted file, so UI:R rather than the vendor's UI:N; local vector, no prior privileges, and total impact in the user's context.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Articles & Coverage 1
AnalysisAI
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps, and Office LTSC for Mac 2021/2024) arises from a use-after-free memory corruption (CWE-416) that lets an attacker run arbitrary code with the victim's privileges. Microsoft's CVSS vector rates it AV:L/PR:N/UI:N (base 8.4) with total technical impact, though there is no public exploit identified at time of analysis and EPSS exploitation probability is negligible at 0.04%. A vendor patch is available from Microsoft (MSRC update guide).
Technical ContextAI
The flaw is a use-after-free (CWE-416), a memory-safety defect in which Office code continues to reference a heap object after it has been freed, allowing an attacker who controls reallocation of that freed memory to corrupt object state and hijack control flow. The CPE data confirms the defect spans the shared Office code base across Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021 and 2024, and the macOS builds Office LTSC for Mac 2021 and 2024 - indicating the vulnerable component is common Office parsing/rendering code rather than a single platform binary. Use-after-free bugs in document parsers are a classic vector for weaponized malicious files that trigger the dangling reference during content processing.
RemediationAI
Apply the Microsoft-released patch via normal Office/Microsoft Update channels; the primary fix is upgrading to the patched builds - Office 2016 to 16.0.5552.1000 and Office LTSC for Mac 2021/2024 to 16.109.26051019, with the corresponding fixed builds for Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps per the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40358 and https://aka.ms/OfficeSecurityReleases). Because exploitation relies on processing a malicious document, interim compensating controls are to open untrusted files in Protected View and block Office from disabling it, enforce Office macro and Mark-of-the-Web restrictions, and filter inbound Office documents at the mail/web gateway; the trade-off is that Protected View and attachment blocking can disrupt legitimate document workflows and require user training. Additional advisory context is available at https://vuldb.com/vuln/363172 and https://nvd.nist.gov/vuln/detail/CVE-2026-40358.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today