EUVD-2026-44184
GHSA-6875-4597-269v
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally so AV:L with UI:R; no privileges needed (PR:N) and low complexity (AC:L); code execution yields full C:H/I:H/A:H.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, and Word 2016) allows an attacker to run arbitrary code by exploiting a use-after-free memory corruption flaw when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.8 with a local attack vector requiring user interaction; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Microsoft, which reported the issue itself, has released a patch.
Technical ContextAI
The root cause is CWE-416 (Use After Free): the Word document-parsing/rendering code frees a memory object but retains and later dereferences a dangling pointer to it, allowing an attacker who controls the reused heap memory to redirect execution. Use-after-free defects in Office file parsers are a classic and reliably exploitable memory-corruption class because attacker-controlled document structures can groom the heap to place controlled data where the freed object was. The CPE set shows the shared Office code affects the entire Office family - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021 and 2024, Office 365/LTSC for Mac 2021 and 2024, Word 2016 - and, because SharePoint servers embed Office document-handling components (Office Web Apps/Word services), SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition are also enumerated as affected.
RemediationAI
Patch available per vendor advisory - apply Microsoft's updates for every affected Office and SharePoint SKU as listed in the MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55032 (exact fixed build numbers were not included in the source data and should be taken from that advisory per product and update channel). For managed Office deployments, ensure the relevant Current/Monthly/Semi-Annual or LTSC channel receives the update and confirm Mac Office builds are updated separately. Until patching completes, reduce exposure by opening untrusted Word documents in Protected View / Application Guard (which sandboxes rendering, at the cost of disabling editing and some features), enforcing Office macro and Mark-of-the-Web restrictions, and filtering inbound Office attachments at the mail gateway; on SharePoint, restrict or disable server-side Office/Word document rendering services where feasible, accepting the trade-off of lost in-browser document preview/editing functionality.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a ma
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today