EUVD-2026-44214
GHSA-6f4x-v88v-3f2g
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open vector so AV:L with mandatory UI:R; no privileges needed (PR:N) and low complexity, with full code execution in user context giving C:H/I:H/A:H.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary code in the context of the current user when a victim opens a maliciously crafted document. The flaw affects a broad Office footprint including Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and related SharePoint Server products that process Word documents. Microsoft has released a patch; no public exploit has been identified at time of analysis, and neither KEV nor EPSS/POC signals were provided in the input.
Technical ContextAI
The root cause is a use-after-free (CWE-416): the Word document parser frees a memory object but retains a dangling reference that is later reused, letting an attacker who controls the freed-then-reallocated memory corrupt program state and hijack control flow. The affected components are Microsoft's Office rich-text/Word document rendering engine as identified by the CPE strings (microsoft_365_apps_for_enterprise, microsoft_office_2019, microsoft_office_365_for_mac, microsoft_office_ltsc_2021/2024, microsoft_office_ltsc_for_mac_2021/2024) plus the server-side document handling in microsoft_sharepoint_enterprise_server_2016, microsoft_sharepoint_server_2019 and the subscription edition, which parse the same file formats. Memory-corruption bugs of this class in Office document parsers are a recurring vector because they process complex, untrusted file structures with legacy code paths.
RemediationAI
Apply the Microsoft security update for CVE-2026-55128 as the primary fix - Patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55128; for Microsoft 365 Apps and Click-to-Run channels ensure automatic updates are current, and for Office 2019/LTSC and SharePoint deploy the corresponding monthly security update. The exact fixed build numbers are not provided in the input and must be taken from the MSRC advisory. Until patching completes, reduce exposure by enabling Protected View and blocking macros/active content for documents from the internet, and configuring Office to open files from untrusted locations in a sandboxed/Protected View mode; note this can disrupt legitimate documents that require editing. Enforce Attack Surface Reduction rules that block Office child-process creation and restrict opening of documents received via email or web, accepting some user-workflow friction as the trade-off. For SharePoint servers, restrict and monitor document upload/processing paths and apply the server-side update promptly.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a ma
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today