EUVD-2026-29640
GHSA-4qm9-v478-vh8f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Office document
-
DeliveryDeliver via email or download
-
ExploitVictim opens file in affected Office
-
ExecutionTrigger use-after-free in parser
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to get their crafted Office file onto the target and, per the typical use-after-free-in-a-document pattern, have the victim open it in an affected Office build - despite the CVSS UI:N flag, realistic exploitation is gated on that user action, which is the key limiting factor. It is bounded to the enumerated Office versions on Windows and macOS (Office 2016/2019, LTSC 2021/2024, 365 Apps, Office LTSC for Mac 2021/2024); it is not remotely automatable (SSVC Automatable: no), grants only the opening user's privileges (S:U, no scope change), and no authentication to a service is needed since it runs in the victim's own session. Note the CVSS AV:L/UI:N combination conflicts with the file-delivery model and should be verified against the MSRC advisory. |
| Impact | Signals here are mixed and lean toward lower real-world priority than the 8.4 base score suggests. CVSS reports AV:L (local) with AC:L, PR:N, UI:N and total C/I/A impact, but the UI:N flag conflicts with the typical Office use-after-free pattern, which requires a victim to open a crafted document - verify with vendor, as realistic exploitation almost certainly needs user interaction. EPSS is very low (0.04%, 14th percentile) and CISA SSVC records Exploitation: none and Automatable: no, consistent with there being no public exploit identified at time of analysis and no CISA KEV listing; only the Technical Impact (total) is high. The net picture is a locally-exploitable, high-impact-if-triggered memory corruption that is not currently being exploited and is not automatable - a patch-in-normal-cycle item rather than an emergency, absent evidence of active targeting. |
| Exploit ScenarioDerived | An attacker crafts a malicious Office document and delivers it to a target via email or a download link; when the victim opens it, parsing triggers the use-after-free and the attacker's shellcode executes with the user's privileges. No public exploit is identified at time of analysis, and the local attack vector plus low complexity mean a single opened file is the realistic trigger. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps, and Office LTSC for Mac 2021/2024) arises from a use-after-free memory corruption (CWE-416) that lets an attacker run arbitrary code with the victim's privileges. Microsoft's CVSS vector rates it AV:L/PR:N/UI:N (base 8.4) with total technical impact, though there is no public exploit identified at time of analysis and EPSS exploitation probability is negligible at 0.04%. A vendor patch is available from Microsoft (MSRC update guide).
RemediationAI
Apply the Microsoft-released patch via normal Office/Microsoft Update channels; the primary fix is upgrading to the patched builds - Office 2016 to 16.0.5552.1000 and Office LTSC for Mac 2021/2024 to 16.109.26051019, with the corresponding fixed builds for Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps per the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40358 and https://aka.ms/OfficeSecurityReleases). Because exploitation relies on processing a malicious document, interim compensating controls are to open untrusted files in Protected View and block Office from disabling it, enforce Office macro and Mark-of-the-Web restrictions, and filter inbound Office documents at the mail/web gateway; the trade-off is that Protected View and attachment blocking can disrupt legitimate document workflows and require user training. Additional advisory context is available at https://vuldb.com/vuln/363172 and https://nvd.nist.gov/vuln/detail/CVE-2026-40358.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416), a memory-safety defect in which Office code continues to reference a heap object after it has been freed, allowing an attacker who controls reallocation of that freed memory to corrupt object state and hijack control flow. The CPE data confirms the defect spans the shared Office code base across Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021 and 2024, and the macOS builds Office LTSC for Mac 2021 and 2024 - indicating the vulnerable component is common Office parsing/rendering code rather than a single platform binary. Use-after-free bugs in document parsers are a classic vector for weaponized malicious files that trigger the dangling reference during content processing.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Use-after-free in a document parser realistically needs the victim to open a crafted file, so UI:R rather than the vendor's UI:N; local vector, no prior privileges, and total impact in the user's context.
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Articles & Coverage 1
Executive ViewAI
Microsoft Office versions 2016 through 2024 contain a high-severity vulnerability allowing attackers with local system access to execute arbitrary code with user privileges, affecting organizations whose employees use these widely-deployed applications. Although no public exploit has been identified and exploitation probability remains negligible, the potential for widespread compromise across the workforce creates significant organizational risk. Microsoft has released a vendor patch that must be deployed across all affected Office installations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Exploit-DB