EUVD-2026-44157
GHSA-87hp-rggg-4jgw
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open vector so AV:L and UI:R; no attacker privileges needed (PR:N); code runs as the user with full C/I/A impact and no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and Office for Mac 2021/2024) arises from a use-after-free memory corruption flaw that an attacker triggers by convincing a user to open a maliciously crafted Office document. Successful exploitation runs arbitrary code in the context of the current user, yielding full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; Microsoft has published a patch via MSRC.
Technical ContextAI
The root cause is CWE-416 (Use After Free): the Office application frees a heap object but retains and later dereferences a dangling pointer to it, allowing an attacker who controls document contents to reclaim the freed allocation with attacker-influenced data and hijack program flow. The affected code is the Office document-parsing/rendering engine shared across the Windows builds (Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024 per the CPE list) and the macOS builds (Office 365/LTSC for Mac 2021 and 2024), indicating the vulnerable component is a cross-platform Office library rather than a Windows-only OS dependency. Use-after-free bugs in complex file-format parsers are a recurring memory-corruption class in Office and are typically reached through crafted structures embedded in a document.
RemediationAI
Apply the Microsoft-released update for your Office channel as the primary fix - Patch available per vendor advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50467); ensure Microsoft 365 Apps and Office 2016/2019/LTSC 2021/LTSC 2024 on Windows and the Office for Mac 2021/2024 builds all receive the corresponding security update, and confirm the exact patched build number from the MSRC page since the input did not specify one. Until patching completes, reduce exposure by opening untrusted documents in Protected View / Application Guard (which sandboxes the parsing that triggers the use-after-free), blocking or quarantining Office attachments from external senders at the mail gateway, and enabling Attack Surface Reduction rules that constrain Office child-process creation; the trade-off is that Protected View and ASR rules can disrupt legitimate macro-enabled or automation workflows and may require user retraining. These are compensating controls only - they do not remove the underlying flaw, so prioritize the update.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today