Microsoft EUVD-2026-22571

This vulnerability exploits CWE-416 (Use After Free), a memory corruption class where a program continues to use a pointer after the memory it references has been freed. In Microsoft Office's case, the flaw exists in core Office components shared across multiple product lines (Office 2016, 2019, LTSC 2021/2024, and Microsoft 365 Apps for Enterprise) on both Windows and macOS platforms. Use-after-free conditions typically occur when object lifecycle management fails, allowing an attacker to manipulate freed memory regions before reallocation. When successfully exploited, the attacker can control program execution flow by placing malicious data in the freed memory location. The broad CPE coverage spanning cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise through cpe:2.3:a:microsoft:microsoft_office_ltsc_for_mac_2024 indicates the vulnerable code exists in shared libraries used across the entire Office product ecosystem since at least the 2016 release cycle.