Microsoft 365 Apps For Enterprise EUVD-2026-22615

The victim must open a crafted malicious document (.doc, .docx, or related Word format) in Microsoft Office Word. Local access required; attacker cannot exploit remotely. No special Word configuration needed—default installations vulnerable.

Real-world risk is moderate-to-high despite the 7.8 CVSS score, requiring careful contextual analysis of multiple signals. The CVSS vector shows local attack (AV:L) with low complexity (AC:L) but mandatory user interaction (UI:R), creating realistic phishing/social engineering scenarios where attackers distribute malicious Word documents via email, cloud storage, or removable media. The PR:N designation confirms unauthenticated attackers can exploit this once the document is opened-no privileged account access required. Impact ratings are maximum (C:H/I:H/A:H), meaning successful exploitation yields complete system compromise including arbitrary code execution, data theft, and denial of service. No public exploit identified at time of analysis reduces immediate weaponization risk, though use-after-free vulnerabilities are well-documented exploitation techniques with established development methodologies. The absence of CISA KEV listing indicates no confirmed active exploitation campaigns in enterprise environments. SSVC framework assessment: exploitation status is publicly-of-concern (PoC-capable vulnerability class), automatable is NO (requires user interaction to open document), technical impact is TOTAL (arbitrary code execution). Microsoft Word's ubiquity in enterprise and government environments creates massive attack surface, but the local/user-interaction requirement provides detection opportunities through email filtering, endpoint protection, and user awareness training. Priority should be HIGH for organizations handling sensitive documents or facing targeted threat actors, MEDIUM for general enterprise patching cycles given patch availability and lack of active exploitation evidence.

An attacker crafts a malicious Word document (.docx or .doc format) containing specially formatted data structures that trigger the use-after-free condition during parsing. The document is delivered via phishing email with social engineering pretexts (invoice, legal notice, HR policy update) convincing the victim to download and open the file. When the victim opens the document in Microsoft Word, the parser deallocates memory during processing, then subsequently accesses the freed memory region now controlled by attacker-supplied content, redirecting execution flow to embedded shellcode that executes with the victim's privilege level, installing malware, stealing credentials, or establishing persistent access to the compromised system.