EUVD-2026-29676
GHSA-qm7q-9qmg-qg28
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privileged local access
-
DeliveryInvoke vulnerable Office component
-
ExploitTrigger use-after-free (CWE-416)
-
ExecutionReclaim freed object with controlled data
-
PersistHijack execution flow
-
ImpactElevate privileges on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a local, already-authorized attacker: the CVSS vector AV:L with PR:L means the attacker must have local access and at least low-level (authenticated standard-user) privileges on the target host before triggering the flaw. No second-user interaction is needed (UI:N) and attack complexity is low (AC:L). The vulnerable code is present in default installations of the listed Office/Microsoft 365 desktop products, so no special non-default feature toggle is documented - the primary limiting factors are the need for prior local code-execution/login as a user and the requirement that a vulnerable, unpatched Office build be installed. This is not remotely reachable over a network without an existing local foothold. |
| Impact | Signals point to a genuine but not urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U) shows a local vector requiring some existing privileges but low complexity and no user interaction, with total impact on confidentiality, integrity, and availability. Countervailing signals lower real-world urgency: EPSS is 0.04% (13th percentile), CISA SSVC lists Exploitation: none and Automatable: no, and there is no KEV listing and no public exploit identified at time of analysis - the SSVC Technical Impact of 'total' aligns with the CVSS impact metrics but does not by itself imply exploitation. One point to verify: the description characterizes this strictly as local privilege elevation, yet the CVSS assigns C:H/I:H/A:H with UI:N, which is broader than a pure DoS despite the 'Denial Of Service' tag - treat the elevation-of-privilege framing as authoritative from Microsoft and the impact metrics as the resulting worst case. Overall this is a standard-cadence patch item rather than an emergency, absent evidence of exploitation. |
| Exploit ScenarioDerived | An attacker who already has a low-privileged foothold on a workstation (for example via phishing malware or a standard user account) runs or opens specially crafted content that drives the vulnerable Office code path, triggering the use-after-free and manipulating the freed object to hijack execution and elevate privileges on the machine. No user interaction by a second victim is required per the CVSS vector (UI:N), and attack complexity is low, but no public exploit is identified at time of analysis, so this remains a plausible rather than demonstrated attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Local privilege elevation in Microsoft Office (Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024) stems from a use-after-free memory corruption flaw (CWE-416) that an already-authorized local attacker can trigger to gain higher privileges on the host. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is very low (0.04%, 13th percentile) and CISA SSVC records exploitation as none, indicating no observed in-the-wild activity. The CVSS 3.1 base score is 7.8 with total technical impact (C:H/I:H/A:H) once triggered.
RemediationAI
Apply the Microsoft-released update for your Office channel; per the precision guidance this is 'Patch available per vendor advisory' - obtain the exact fixed build from the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40419 and the Office security releases index at https://aka.ms/OfficeSecurityReleases, then match it to your servicing channel (Current Channel, Monthly Enterprise, or the LTSC/Office 2019 MSI builds). For click-to-run installs, ensure automatic updates are enabled and force an update; for volume-licensed Office 2019/LTSC deployments, push the corresponding security update through your patch-management system. Because exploitation requires an already-authenticated local user, compensating controls where immediate patching is not possible include enforcing least privilege on endpoints (do not run daily as local admin), restricting who can log on interactively to sensitive hosts, and keeping Office attack-surface-reduction and Protected View settings enabled - trade-off: these reduce but do not eliminate the local elevation risk and may affect macro/add-in workflows.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free): Office code frees a memory object but retains and later dereferences a dangling pointer to it, allowing an attacker who can influence the reallocated memory to corrupt program state and hijack execution flow within the Office process. The affected code is shared across the Office application suite, as reflected in the CPE data covering cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_office_2019, microsoft_office_ltsc_2021, and microsoft_office_ltsc_2024. Use-after-free bugs in document-parsing/rendering components are a recurring class in Office; the 'Denial Of Service' and 'Memory Corruption' tags are consistent with the availability impact, while the confidentiality and integrity impact reflect the potential to run attacker-controlled code in the security context targeted by the elevation.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege elevation by an authorized user gives AV:L/PR:L, no second-user interaction needed (UI:N), low complexity, and a use-after-free yielding total C/I/A impact within an unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Local privilege escalation in Microsoft Office (2019, LTSC 2021/2024, and Microsoft 365 Apps for Enterprise) could allow currently-authorized users to elevate system access to administrative levels, creating risk of unauthorized data access and lateral movement within corporate networks. A vendor patch is available and no active exploitation has been observed, enabling controlled remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Exploit-DB