EUVD-2026-22361Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver weaponized Word document via email/download
-
DeliveryUser opens document in vulnerable Word version
-
ExploitTrigger use-after-free during document parsing
-
ExecutionManipulate freed memory region
-
PersistRedirect execution flow
-
ImpactExecute arbitrary code with user privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must open a crafted document in Microsoft Office Word. Requires local access (AV:L) with user interaction to open the file. Affects Word on Windows systems where the victim has permissions to execute documents. Default installations vulnerable if Word is installed. |
| Impact | Real-world risk is moderate-to-high but requires significant user interaction hurdles. CVSS 7.8 severity derives from local attack vector (AV:L) with low complexity (AC:L) but mandatory user interaction (UI:R) and no privileges required (PR:N). The attack cannot be executed remotely without social engineering to deliver the malicious document. EPSS data not provided, but historical Microsoft Office memory corruption vulnerabilities show moderate exploitation probability when weaponized in targeted campaigns. No CISA KEV listing indicates no confirmed active exploitation in the wild. Patch availability from Microsoft significantly reduces window of exposure for organizations with routine update cycles. The requirement for users to open untrusted Word documents provides natural defensive opportunities through security awareness training and email filtering. Organizations with robust endpoint protection and application whitelisting face reduced risk compared to those relying solely on user vigilance. The SSVC framework would likely categorize this as scheduled patching priority rather than emergency response, given local attack vector and available patch, unless specific threat intelligence indicates targeting of the organization's sector. |
| Exploit ScenarioDerived | An attacker crafts a malicious Word document containing specially formatted content that triggers the use-after-free condition during parsing. The document is delivered via spear-phishing email or placed on a file share accessible to the target. When the victim opens the document in Microsoft Word, the application attempts to render the malicious content, freeing a memory region while retaining pointers to it. The attacker's payload manipulates the freed memory to redirect execution flow, achieving arbitrary code execution with the privileges of the Word process, typically equivalent to the logged-in user's permissions, enabling installation of malware, data exfiltration, or lateral movement within the network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Local code execution in Microsoft Office Word via use-after-free memory corruption affects Microsoft 365 Apps for Enterprise and Office LTSC 2024. Unauthenticated attackers can achieve full system compromise (confidentiality, integrity, availability) by inducing users to open specially crafted Word documents, triggering memory reuse vulnerabilities during document parsing. Vendor patch available via Microsoft Security Response Center. No public exploit identified at time of analysis, though CVSS 7.8 indicates high severity when user interaction occurs.
RemediationAI
Apply security updates provided by Microsoft through the official Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23657. Organizations using Microsoft 365 Apps for Enterprise should update beyond version 16.0.1, and those using Office LTSC 2024 should update beyond version 16.0.0, with specific patched versions detailed at https://aka.ms/OfficeSecurityReleases. Enable automatic updates for Microsoft Office products where feasible to ensure timely patch deployment. As interim mitigation until patches are applied, implement strict controls on opening Word documents from untrusted sources, enforce Protected View settings in Word to sandbox potentially malicious documents, and deploy email gateway filtering to block suspicious Office file attachments. Application whitelisting and endpoint detection solutions can provide additional defense-in-depth layers by detecting abnormal behavior from Word processes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in microsoft
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from a use-after-free condition (CWE-416) in Microsoft Word's document processing engine. Use-after-free vulnerabilities occur when application code continues to reference memory after it has been deallocated, allowing attackers to manipulate freed memory regions and redirect program execution flow. The affected products per CPE strings are Microsoft 365 Apps for Enterprise (version 16.0.1 and earlier) and Microsoft Office LTSC 2024 (version 16.0.0 and earlier), both using the shared Office document rendering infrastructure. The local attack vector indicates exploitation requires the malicious document to be opened on the target system, rather than remote network-based exploitation. Tags indicate this can cause memory corruption leading to denial of service or arbitrary code execution depending on exploitation technique.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Executive ViewAI
Microsoft Office Word contains a local code execution vulnerability (CVE-2026-23657) that allows attackers to compromise systems when users open malicious Word documents, affecting Microsoft 365 Apps for Enterprise and Office LTSC 2024. This vulnerability poses significant risk to organizational confidentiality, integrity, and availability since exploitation requires only user interaction with a crafted document. Leadership should prioritize patching to prevent potential data theft, system manipulation, and operational disruption across the enterprise.
Apply vendor patch. Interim mitigations pending patch deployment: disable Word macros and dynamic content via Group Policy, restrict execution of Office applications from suspicious file paths, and educate users on risks of opening unsolicited Word documents from untrusted sources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
GitHub PoC
Exploit-DB