EUVD-2026-44152
GHSA-2h9j-hxw7-2jf3
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Document must be opened by a user so AV:L and UI:R; no prior privileges needed (PR:N) and code runs as the user granting full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office (including Microsoft 365 Apps for Enterprise, Office 2016/2019, and Office LTSC 2021/2024) stems from a use-after-free memory-corruption flaw (CWE-416). An attacker who convinces a user to open a specially crafted Office document can execute arbitrary code in the context of the current user, gaining full confidentiality, integrity, and availability impact. Exploitation requires user interaction (opening a malicious file) and there is no public exploit identified at time of analysis.
Technical ContextAI
The root cause is a use-after-free (CWE-416): Office frees a heap object but retains a dangling pointer that is later dereferenced, letting a crafted document control the freed memory region to hijack execution flow. This class of bug is common in the complex file-format parsers embedded across the Office suite (Word, Excel, PowerPoint, etc.). The CPE data confirms the affected footprint is the Office application layer - cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_office_2016, microsoft_office_2019, microsoft_office_ltsc_2021, and microsoft_office_ltsc_2024 - meaning both perpetual-license and subscription (Click-to-Run) editions share the vulnerable code path. Tags note both memory corruption and denial-of-service as potential outcomes of the freed-object dereference.
RemediationAI
Patch available per vendor advisory - apply the Microsoft update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47290; exact fixed build numbers were not included in the provided data, so retrieve them from that MSRC page and deploy the corresponding cumulative or Click-to-Run update for each edition. Microsoft 365 Apps and Office LTSC channels update through Click-to-Run, while Office 2016/2019 receive the fix via Windows Update or the Microsoft Update Catalog. Until patching completes, reduce exposure by configuring Office to open documents from the internet in Protected View and blocking Mark-of-the-Web-tagged files from being edited, which contains the crafted-document vector at the cost of user convenience when editing external files; user-awareness measures against opening unsolicited attachments are a partial compensating control but do not remediate the underlying use-after-free.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today