EUVD-2026-29676
GHSA-qm7q-9qmg-qg28
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege elevation by an authorized user gives AV:L/PR:L, no second-user interaction needed (UI:N), low complexity, and a use-after-free yielding total C/I/A impact within an unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege elevation in Microsoft Office (Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024) stems from a use-after-free memory corruption flaw (CWE-416) that an already-authorized local attacker can trigger to gain higher privileges on the host. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is very low (0.04%, 13th percentile) and CISA SSVC records exploitation as none, indicating no observed in-the-wild activity. The CVSS 3.1 base score is 7.8 with total technical impact (C:H/I:H/A:H) once triggered.
Technical ContextAI
The root cause is CWE-416 (Use After Free): Office code frees a memory object but retains and later dereferences a dangling pointer to it, allowing an attacker who can influence the reallocated memory to corrupt program state and hijack execution flow within the Office process. The affected code is shared across the Office application suite, as reflected in the CPE data covering cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_office_2019, microsoft_office_ltsc_2021, and microsoft_office_ltsc_2024. Use-after-free bugs in document-parsing/rendering components are a recurring class in Office; the 'Denial Of Service' and 'Memory Corruption' tags are consistent with the availability impact, while the confidentiality and integrity impact reflect the potential to run attacker-controlled code in the security context targeted by the elevation.
RemediationAI
Apply the Microsoft-released update for your Office channel; per the precision guidance this is 'Patch available per vendor advisory' - obtain the exact fixed build from the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40419 and the Office security releases index at https://aka.ms/OfficeSecurityReleases, then match it to your servicing channel (Current Channel, Monthly Enterprise, or the LTSC/Office 2019 MSI builds). For click-to-run installs, ensure automatic updates are enabled and force an update; for volume-licensed Office 2019/LTSC deployments, push the corresponding security update through your patch-management system. Because exploitation requires an already-authenticated local user, compensating controls where immediate patching is not possible include enforcing least privilege on endpoints (do not run daily as local admin), restricting who can log on interactively to sensitive hosts, and keeping Office attack-surface-reduction and Protected View settings enabled - trade-off: these reduce but do not eliminate the local elevation risk and may affect macro/add-in workflows.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today