EUVD-2026-73274
GHSA-mpf5-fg2g-h5xp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered document, no privileges needed, user must open file (UI:R), full host compromise upon successful double-free exploitation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution via a double-free memory corruption flaw (CWE-415) in Microsoft Office Word enables an unauthenticated network-reachable attacker to execute arbitrary code on a victim's machine when the victim opens or previews a specially crafted document (UI:R). The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full host compromise upon successful exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must open or preview a specially crafted document file in Microsoft Office Word. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) indicates low-complexity network exploitation requiring only that the victim open a malicious document - a realistic phishing scenario with no elevated privileges required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch via Windows Update or the Microsoft Update Catalog, targeting the fixed builds listed above for each Windows version (e.g., Windows 11 24H2 to 10.0.26100.9445 or later, Windows Server 2025 to 10.0.26100.33438 or later). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify patch availability through Microsoft Security Response Center and issue an urgent communication to all staff directing them to avoid opening documents from untrusted external sources until systems are patched. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-415 – Double Free
View allShare
External POC / Exploit Code
Leaving vuln.today