Microsoft Office CVE-2026-50467

Exploitation requires the victim to open an attacker-supplied malicious Office document on the local machine (AV:L with UI:R) - the attacker cannot trigger the flaw remotely without user action. No authentication or elevated privileges are needed on the attacker's part (PR:N), and the flaw affects default Office installations, so no special product feature or non-default configuration is required to be vulnerable. The primary limiting factors are the mandatory user interaction of opening the crafted file and the fact that code runs only at the current user's privilege level (S:U), meaning Protected View, sandboxing, or a low-privilege user account each meaningfully constrain real-world impact.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - local attack vector, low complexity, no privileges required, but mandatory user interaction (opening a file). This is a classic 'open a malicious document' profile: high impact if triggered, but gated behind social engineering rather than remote self-propagation. No EPSS score, SSVC decision, POC, or KEV signal was provided in the input, so exploitation probability cannot be quantified from the data; the absence of KEV means no confirmed active exploitation. Note the tag set includes 'Denial Of Service' which is narrower than the CVSS C:H/I:H/A:H code-execution impact - the CVSS and MSRC framing of code execution should be treated as authoritative over the tag. Overall this is a legitimately high-priority patch given Office's ubiquity and the low technical bar to exploit once a user opens the file, but it is not a network-wormable emergency.

An attacker emails a crafted Office document (or hosts it on a web/file share) and uses social engineering to get a target to open it; the file contains malformed structures that trigger the use-after-free, corrupting the heap and executing attacker code in the user's security context. No public exploit is identified at time of analysis, and exploitation requires the victim to open the file (UI:R) rather than any remote trigger.