EUVD-2026-44152
GHSA-2h9j-hxw7-2jf3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Office document to victim
-
DeliveryUser opens malicious file
-
ExploitTrigger use-after-free in Office parser
-
ExecutionDereference dangling pointer / hijack flow
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted Office document (UI:R user interaction is mandatory per the CVSS vector), and code executes only in the context of the user who opens the file. No authentication or prior privileges on the target are needed (PR:N), and complexity is Low (AC:L), but the Local vector (AV:L) means there is no remote/network-triggered path - delivery depends on getting the malicious file to the user and having them open it. Key limiting factors: Protected View / Mark-of-the-Web sandboxing can block the trigger for files from the internet, and the impact is bounded by the privilege level of the opening user rather than SYSTEM. |
| Impact | The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a high-impact but user-interaction-gated flaw: the attack vector is Local because it requires opening a file, complexity is Low, no privileges are needed, but UI:R means a victim must act. There is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active exploitation or a modeled exploitation probability - treat this as no public exploit identified at time of analysis rather than an imminent threat. The tags list Denial Of Service alongside code execution, which is consistent with a UAF that may only crash rather than reliably achieve RCE depending on heap grooming. Given Office's enormous install base, the realistic priority is driven by prevalence and phishing exposure rather than by any confirmed in-the-wild signal; patch during the normal Patch Tuesday cycle and prioritize if targeted phishing against your users is a concern. |
| Exploit ScenarioDerived | An attacker crafts a malicious Office document that triggers the use-after-free and emails it to a target as a plausible attachment (invoice, resume, report). When the victim opens the file and dismisses or bypasses Protected View, the dangling pointer is dereferenced, letting the attacker's payload execute code with the victim's privileges. No public proof-of-concept has been identified at time of analysis, and the Local vector plus required user interaction mean the attack hinges on successful social engineering. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Local code execution in Microsoft Office (including Microsoft 365 Apps for Enterprise, Office 2016/2019, and Office LTSC 2021/2024) stems from a use-after-free memory-corruption flaw (CWE-416). An attacker who convinces a user to open a specially crafted Office document can execute arbitrary code in the context of the current user, gaining full confidentiality, integrity, and availability impact. Exploitation requires user interaction (opening a malicious file) and there is no public exploit identified at time of analysis.
RemediationAI
Patch available per vendor advisory - apply the Microsoft update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47290; exact fixed build numbers were not included in the provided data, so retrieve them from that MSRC page and deploy the corresponding cumulative or Click-to-Run update for each edition. Microsoft 365 Apps and Office LTSC channels update through Click-to-Run, while Office 2016/2019 receive the fix via Windows Update or the Microsoft Update Catalog. Until patching completes, reduce exposure by configuring Office to open documents from the internet in Protected View and blocking Mark-of-the-Web-tagged files from being edited, which contains the crafted-document vector at the cost of user convenience when editing external files; user-awareness measures against opening unsolicited attachments are a partial compensating control but do not remediate the underlying use-after-free.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a use-after-free (CWE-416): Office frees a heap object but retains a dangling pointer that is later dereferenced, letting a crafted document control the freed memory region to hijack execution flow. This class of bug is common in the complex file-format parsers embedded across the Office suite (Word, Excel, PowerPoint, etc.). The CPE data confirms the affected footprint is the Office application layer - cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_office_2016, microsoft_office_2019, microsoft_office_ltsc_2021, and microsoft_office_ltsc_2024 - meaning both perpetual-license and subscription (Click-to-Run) editions share the vulnerable code path. Tags note both memory corruption and denial-of-service as potential outcomes of the freed-object dereference.
Know when Microsoft 365 Apps For Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Document must be opened by a user so AV:L and UI:R; no prior privileges needed (PR:N) and code runs as the user granting full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Executive ViewAI
CVE-2026-47290 is a use-after-free memory vulnerability in Microsoft Office that enables remote code execution when users open malicious documents, affecting Office 365 Apps for Enterprise, Office 2016/2019, and Office LTSC 2021/2024. The vulnerability poses direct organizational risk to data confidentiality and system integrity, as attackers can gain full user-level access through document-based social engineering. No public exploit identified at time of analysis, but the simplicity of attack delivery via email attachment requires urgent patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Exploit-DB