Microsoft Office CVE-2026-50314

Exploitation requires a victim to open a specially crafted Office document (Word/Excel/PowerPoint/OLE) on an affected build - the CVSS UI:R metric makes user interaction mandatory, so this cannot be triggered without the target opening the malicious file. The attack vector is local (AV:L), meaning the crafted file must reach and be processed on the target host rather than being exploited over the network. No prior authentication or privileges are needed (PR:N), and code runs at the current user's privilege level. Limiting factors: Office Protected View / Mark-of-the-Web sandboxing will open Internet-sourced documents in read-only mode first, so exploitation generally depends on the user clicking 'Enable Editing' or the file bypassing MotW; the flaw affects both Windows and macOS Office editions listed in the CPE data.

The signals are moderate-to-serious but not emergency-tier. The CVSS 3.1 vector is AV:L (local) with UI:R, meaning exploitation is not remote-network-automatable and depends on convincing a user to open a crafted file - consistent with a client-side document attack rather than a wormable server bug. PR:N indicates no pre-existing privileges are needed, but the UI:R requirement and local attack vector materially lower real-world automatability. No EPSS score was supplied and the CVE is absent from CISA KEV, and no POC is referenced, so there is no evidence of active or widespread exploitation; the tags additionally list 'Denial Of Service' alongside memory corruption, which is broadly consistent with a UAF that can crash or, in the worst case, execute code. Net: a genuine patch-soon priority for any environment running Office (especially where users routinely open external documents), but below the urgency of a network-exploitable or actively-exploited flaw. Note the tag 'Denial Of Service' is narrower than the description's 'execute code' claim - the code-execution impact per the C:H/I:H CVSS metrics should be treated as authoritative.

An attacker crafts a malicious Office document that triggers the use-after-free during parsing and delivers it via phishing email or a download link. When the victim opens the file and enables editing/content, the dangling pointer is exploited to execute code in the user's security context, enabling malware installation or data theft. No public POC is identified at this time, and the AV:L/UI:R profile means the attack hinges on social engineering the user into opening the file.