What is the CVSS score of CVE-2026-70311?

CVE-2026-70311 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Office Word are affected by CVE-2026-70311?

Microsoft Office Word use-after-free vulnerability (CVE-2026-70311, CVSS 7.8) enables attackers to execute arbitrary code when users open specially crafted documents, with no patch currently…. A patch is available.

How to fix or mitigate CVE-2026-70311?

Within 24 hours, conduct emergency inventory of Word installations across all user endpoints and distribution lists; notify users via email and security brief that opening Word documents from untrusted sources presents immediate risk, with emphasis on external communications and file-sharing platforms. Within 7 days, enforce interim mitigations: disable macros by default via Group Policy or Microsoft 365 admin center, enable Protected View for all users, configure email gateways to quarantine Office files from external senders, and establish daily monitoring of Microsoft security advisories for CVE-2026-70311 patches. Within 30 days, once Microsoft releases a patch, prioritize deployment of the patch to all Office installations and verify coverage within 72 hours; maintain daily threat intelligence watch for exploit development during the interim period.

Microsoft Office Word CVE-2026-70311

EUVD-2026-56568 HIGH

Use After Free (CWE-416)

2026-08-11 secure@microsoft.com

GHSA-q435-q689-9ppx

Denial Of Service Use After Free Memory Corruption Microsoft 365 Apps Word Microsoft 365 Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

vuln.today AI

7.8 HIGH

AV:L and UI:R reflect document-open delivery; PR:N because no system account privilege is needed; S:U as code runs in Word process only.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 17:55 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 7.8

DescriptionCVE.org

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

AnalysisAI

Use-after-free memory corruption in Microsoft Office Word enables local code execution when a user opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms this is a social-engineering-dependent attack - no system privileges are required, but the victim must open a malicious file, making phishing or drive-by document delivery the likely delivery mechanism. All three impact dimensions (Confidentiality, Integrity, Availability) are rated High, yielding a 7.8 CVSS score; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CWE-416 (Use After Free) describes a condition where software continues to use a pointer after the memory it references has been freed, allowing an attacker to craft heap conditions that redirect that dangling pointer to attacker-controlled data - ultimately hijacking the instruction pointer. In Microsoft Office Word, this flaw resides in the document parsing or rendering engine; when processing a maliciously structured file, the freed memory region can be reclaimed and populated by attacker data before the stale reference is dereferenced. This class of vulnerability is well-understood and regularly exploitable when heap layout can be reliably influenced via file content, which document formats such as .docx (which embed complex embedded objects, styles, and OLE structures) readily permit. The CVSS local attack vector (AV:L) with user interaction (UI:R) is consistent with a weaponized Office document as the exploitation primitive.

RemediationAI

Apply the Microsoft security update published for CVE-2026-70311 via the Microsoft Update Catalog or Windows Update; the exact patched version must be retrieved from the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70311, as no specific fix version was included in the available intelligence. As a compensating control prior to patching, organizations can enable Microsoft Office Protected View and Attack Surface Reduction (ASR) rules - specifically the rule 'Block Office applications from creating child processes' - which can prevent post-exploitation payload execution even if the UAF is triggered; note this may break macro-dependent workflows. Additionally, deploying WDAC (Windows Defender Application Control) or AppLocker policies to restrict Word from spawning unsigned child processes reduces post-exploitation impact. Disabling macros via Group Policy and enforcing document origin trust policies (Mark of the Web enforcement) further increases delivery friction. No vendor-released patch version was independently confirmed from the provided data.