EUVD-2026-29643
GHSA-vcq9-67c7-g6vr
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local file-parsing use-after-free realistically needs the victim to open a crafted document, so AV:L and UI:R; no privileges required (PR:N), and successful exploitation yields full code execution as the user (C:H/I:H/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Articles & Coverage 1
AnalysisAI
Local code execution in Microsoft Office Word (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and Office LTSC for Mac 2021/2024) arises from a use-after-free memory-corruption flaw that lets an attacker run arbitrary code in the context of the user who opens a maliciously crafted document. Microsoft has released a patch, and no public exploit has been identified at time of analysis; EPSS is very low at 0.06% (18th percentile) and CISA SSVC records no known exploitation.
Technical ContextAI
The root cause is CWE-416 (Use After Free): Word's document-parsing/rendering engine frees a memory object but continues to reference the dangling pointer, allowing an attacker to reclaim that memory with controlled data and corrupt program state to hijack execution. This affects the shared Office Word code base across Windows builds (Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, Word 2016) and the macOS builds (Office LTSC for Mac 2021/2024) per the CPE set, indicating the vulnerable component is the cross-platform Word file-format handling code rather than an OS-specific module. The 'Denial Of Service' and 'Memory Corruption' tags are consistent with use-after-free, which can yield either a crash or, with a reliable heap groom, arbitrary code execution.
RemediationAI
Apply the Microsoft update: Patch available per vendor advisory (MSRC), with confirmed fixed builds of Microsoft Word 2016 at 16.0.5552.1000 and Office LTSC for Mac 2021/2024 at 16.109.26051019; for click-to-run/365, LTSC 2021/2024, and Office 2019, install the current security build delivered through https://aka.ms/OfficeSecurityReleases and referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40361. Where immediate patching is not possible, reduce exposure by opening untrusted documents in Protected View / Application Guard (which sandboxes parsing at the cost of disabling editing until the user explicitly trusts the file), blocking or quarantining Word documents from external email and web sources at the mail/proxy gateway (may delay legitimate business documents), and enforcing 'Block macros from the Internet' and Mark-of-the-Web handling - though note these macro controls do not directly stop a memory-corruption bug in the file parser and are only partial compensating controls.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today