EUVD-2026-44201
GHSA-wccm-7wfc-h3w3
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-open client RCE: AV:L and UI:R because the victim must open a crafted document, PR:N as no auth is needed, and full C/I/A High from arbitrary code execution.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for Mac) stems from a double free of heap memory (CWE-415) that lets an unauthorized attacker run arbitrary code when a victim opens a malicious document. The flaw was reported by Microsoft, carries CVSS 7.8, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because exploitation requires the target to open a crafted file (UI:R), it is a user-interaction-gated client-side RCE rather than a remotely-triggerable service bug.
Technical ContextAI
The root cause is CWE-415 (Double Free): the same heap allocation is released twice during Word's parsing/handling of a document, corrupting heap metadata or freelist state. An attacker who controls the freed-then-reallocated memory can pivot heap corruption into controlled writes and ultimately arbitrary code execution in the context of the Office process. The CPE set shows the parsing code is shared broadly across the Office family - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021 and 2024 (Windows and Mac), Office 365 for Mac, and the SharePoint Server 2016/2019/Subscription Edition products that embed Office document-handling components - indicating a common file-processing module rather than a single edition-specific bug.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55132 for each affected SKU (Microsoft 365 Apps via Click-to-Run channel updates, Office LTSC 2021/2024 and Office 2019 via the corresponding MSI/Click-to-Run packages, Office for Mac via AutoUpdate, and SharePoint 2016/2019/Subscription Edition server updates); the advisory contains the exact fixed build numbers, which are not reproduced in the input data. Until patching completes, reduce exposure by opening untrusted documents in Protected View / Application Guard (limits the exploit to a sandboxed process, with a usability trade-off that macros and editing are blocked), blocking or quarantining Office attachments from external senders at the mail gateway (may delay legitimate business documents), and enabling attack-surface-reduction rules for Office child-process creation on Windows endpoints. These are compensating controls only; the vendor patch is the definitive fix.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a ma
Same weakness CWE-415 – Double Free
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today