EUVD-2026-29648
GHSA-gw2g-hq8h-6fvx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Word document
-
DeliveryDeliver via email or file share
-
ExploitVictim opens document in vulnerable Word
-
ExecutionTrigger use-after-free in parser
-
PersistHijack freed object via heap grooming
-
ImpactExecute code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to process an attacker-supplied malicious Word document with a vulnerable Office/Word build (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, or Office LTSC for Mac 2021/2024); the attack vector is local (AV:L), meaning the crafted file must be delivered to and opened on the target host rather than exploited over the network. The stated CVSS vector claims UI:N (no user interaction), but for a Word document-parsing use-after-free the realistic limiting factor is user interaction - the target opening or previewing the file - so this UI:N assertion should be verified against Microsoft's advisory. Additional limiting factors: exploitation is not automatable per SSVC, scope is unchanged (code runs only as the current user, not elevated), and success depends on reliable heap grooming, so unpatched-but-hardened environments (Protected View, ASR) meaningfully raise the bar. |
| Impact | Severity signals are mixed and worth reconciling. CVSS is 8.4 (High) with C:H/I:H/A:H and AC:L, and SSVC calls technical impact 'total,' which argues for meaningful risk if exploited. However, the exploitation-likelihood signals are low: EPSS is 0.04% (14th percentile), SSVC exploitation status is 'none,' SSVC automatable is 'no,' and there is no KEV listing and no public exploit. A notable inconsistency: the provided CVSS vector is AV:L/UI:N, yet a Word use-after-free is realistically triggered by a user opening or previewing a malicious document, which normally implies UI:R (user interaction required) - verify the delivery model with Microsoft's MSRC advisory, as UI:N would materially raise real-world risk. Net assessment: a genuinely high-impact-if-triggered but low-probability, non-automatable, single-user-scope local bug - a routine prioritized patch, not a drop-everything emergency, absent evidence of active exploitation. |
| Exploit ScenarioDerived | An attacker emails or otherwise delivers a specially crafted Word document to a targeted user; when the victim opens (or previews) the file, Word's parser frees and then reuses a corrupted object, and the attacker's heap-grooming causes arbitrary code to run with the victim's privileges. Because SSVC marks the bug non-automatable and no public exploit exists, this would require a bespoke exploit and social engineering rather than mass automated attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Local code execution in Microsoft Word (and the Office suites that bundle it - Office 2016/2019, LTSC 2021/2024, Microsoft 365 Apps, and Office LTSC for Mac 2021/2024) stems from a use-after-free memory-corruption defect that lets an attacker run arbitrary code in the context of the current user, typically by having the victim process a crafted document. Microsoft (the reporting party) has released a fix; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 14th percentile). SSVC rates exploitation as none but technical impact as total, so this is a patch-on-schedule item rather than an emergency.
RemediationAI
Vendor-released patch: apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40366 - for Microsoft Word 2016 update to build 16.0.5552.1000 or later, and for Office LTSC for Mac 2021/2024 update to 16.109.26051019 or later; Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024 receive the fix through their respective Office update channels (Click-to-Run / Windows Update / Microsoft Update). Until patches are deployed, reduce exposure by opening untrusted documents in Protected View and keeping it enabled for internet and Outlook attachments, blocking or sandboxing inbound Office documents at the mail gateway, and enabling Attack Surface Reduction rules that constrain Office child-process and memory behavior; note these controls can interrupt legitimate document workflows and macro-enabled business processes, so validate before broad enforcement. Track the advisory under ENISA EUVD-2026-29648.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free in Microsoft Word's document-processing engine, the shared parsing/rendering code reused across the Office family. A use-after-free occurs when memory is freed but a dangling pointer is later dereferenced; an attacker who controls document structure can groom the heap so the freed object is replaced with attacker-controlled data, converting the dangling reference into a controlled read/write and ultimately code execution. The CPE set confirms the affected code ships in cpe:2.3:a:microsoft:microsoft_word_2016, microsoft_office_2019, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, microsoft_365_apps_for_enterprise, and the two Office LTSC for Mac (2021, 2024) editions, indicating the vulnerable component is common to both Windows and macOS Word builds. The 'Denial Of Service' and 'Memory Corruption' tags reflect that the same corruption can also crash the process.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local document-open UAF: AV:L and UI:R because the victim must open a crafted file; PR:N as no prior auth is needed; full C/I/A impact at unchanged user scope.
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Articles & Coverage 1
Executive ViewAI
A use-after-free vulnerability in Microsoft Office products (Office 2016, 2019, LTSC 2021/2024, and Microsoft 365 Apps) enables local code execution when users open crafted documents, creating compromise risk across any organization where document exchange is routine. While no public exploit has been identified and current exploitation probability is extremely low, the ubiquity of Office means exposure spans most of the workforce. Patch deployment within 30 days will eliminate this technical risk without disruption to normal operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Exploit-DB