Microsoft Office Word: Remote code execution through use-after-free
Summary
A use-after-free vulnerability (CWE-416) in Microsoft Office Word allows an unauthorized attacker to execute code over a network. A user must open a malicious Word file, for example one received by email or downloaded from the internet. Successful exploitation could fully compromise confidentiality, integrity and availability of the affected system. Microsoft 365 Apps and Office LTSC clients are affected.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 up to the build given at aka.ms/OfficeSecurityReleases (exact build unknown)
- Office 365 for Mac: before 16.114.26101123
- Office LTSC 2021: before 16.0.14334.20974
- Office LTSC 2024: before 16.0.17932.21056
- Office LTSC for Mac 2021: before 16.114.26101123
- Office LTSC for Mac 2024: before 16.114.26101123
Fixed in
- Office 365 for Mac and Office LTSC for Mac: 16.114.26101123 (first fixed build per CNA record, not yet verified on MSRC)
- Office LTSC 2021: 16.0.14334.20974 (same caveat)
- Office LTSC 2024: 16.0.17932.21056 (same caveat)
- Microsoft 365 Apps for Enterprise: Unknown, see aka.ms/OfficeSecurityReleases
Workaround
Unknown. No vendor workaround identified. Until patched, restrict opening of documents from untrusted sources and keep Protected View enabled; whether Protected View mitigates this flaw is not verified.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept or in-the-wild exploitation confirmed in the research.
- EPSS: unknown.
Our recommendation
- Install the Microsoft security update for Microsoft 365 Apps and Office LTSC clients through the normal update channel.
- Check the installed build on each endpoint against the MSRC table and aka.ms/OfficeSecurityReleases.
- Until patched, block or quarantine Word files from untrusted sources at the mail gateway and in file sharing.
- Monitor for unusual Word process activity. Treat as high priority.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-108442 msrc.microsoft.com
- OpenCVE: CVE-2026-108442 app.opencve.io
- VulDB: CVE-2026-108442 vuldb.com
- Vulners: VulnRichment CVE-2026-108442 vulners.com
- OffSeq Radar: CVE-2026-108442 radar.offseq.com
- ThehackerWire: CVE-2026-108442 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:23.
Original description (NVD)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.