EUVD-2026-44156
GHSA-7938-fgc9-gw6v
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local document-open attack requires user interaction (AV:L/UI:R) with no prior privileges (PR:N); successful UAF yields full code execution as the user, so C/I/A all High.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and the macOS editions) arises from a use-after-free memory-corruption flaw (CWE-416) that lets an attacker run arbitrary code in the context of the current user after the victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R) with high impact to confidentiality, integrity, and availability, and requires user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch is available via MSRC.
Technical ContextAI
The root cause is CWE-416 Use After Free, a class of memory-corruption bug in which the application continues to reference heap memory that has already been freed, allowing an attacker who controls the reallocated contents to hijack the dangling pointer and steer execution. In Office this typically stems from malformed structures inside a document file (Word/Excel/PowerPoint/OLE parsing) that trigger premature object destruction while a reference is still live. The CPE set confirms the affected code is the Office application layer (cpe:2.3:a:microsoft) spanning Windows builds - Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021 and LTSC 2024 - and the macOS builds Office 365 for Mac plus Office LTSC for Mac 2021/2024, indicating shared cross-platform parsing code rather than an OS-specific defect.
RemediationAI
Patch available per vendor advisory: apply the Microsoft update for your Office channel as published on the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50314; exact fixed build numbers are not included in the supplied data and should be taken from that advisory per product (Microsoft 365 Apps auto-update channel, Office LTSC/2016/2019 via Microsoft Update or Click-to-Run, and the macOS builds via Microsoft AutoUpdate). Until patching completes, reduce exposure by ensuring Protected View is enabled for files originating from the Internet and email attachments so untrusted documents open in a sandboxed, read-only mode (trade-off: users must click 'Enable Editing', adding friction), and by blocking or quarantining Office document types at the mail gateway from untrusted senders (trade-off: may delay legitimate external documents). Enabling Attack Surface Reduction rules and Office macro/child-process restrictions provides additional defense, though this UAF is triggered by document parsing rather than macros, so those controls are supplementary rather than a substitute for the patch.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today