Microsoft Office Word: Remote code execution through use-after-free
Summary
Microsoft Office Word contains a use-after-free memory flaw (CWE-416) that allows an unauthenticated attacker to execute code over a network. The attacker needs a user to open a crafted Word file, for example one delivered as an email attachment or download. The vendor and the CISA SSVC assessment rate the impact as total, but no active exploitation or public proof of concept has been found.
Affected
- Microsoft 365 Apps for Enterprise: 16.0.1 up to the fixed build listed in the Microsoft advisory
- Microsoft Office 365 for Mac: 1.0.0 to before 16.115.26110837
- Microsoft Office LTSC 2021: 16.0.1 to before 16.0.14334.21048
- Microsoft Office LTSC 2024: 16.0.0 to before 16.0.17932.21140
- Microsoft Office LTSC for Mac 2021: 16.0.1 to before 16.115.26110837
- Microsoft Office LTSC for Mac 2024: 16.0.0 to before 16.115.26110837
Fixed in
- Apply the November 2026 Microsoft Office security updates.
- Microsoft 365 Apps for Enterprise: fixed build per the Microsoft release page (https://aka.ms/OfficeSecurityReleases), not stated in the CVE record.
- Build numbers above are from the CVE record and should be checked against the MSRC advisory.
Workaround
No workaround is documented in the sources reviewed. Patching is the fix.
Exploitation
- Exploited in the wild: none found. CISA SSVC lists exploitation as none.
- Public proof of concept: none found.
- Automatable (CISA SSVC): no.
- Microsoft's exploitability fields were not retrieved.
Our recommendation
- Install the November 2026 Office updates on all affected systems, including Microsoft 365 Apps and Office LTSC or Mac installations.
- Prioritise systems where staff open Word attachments from external senders.
- Until patched, restrict opening untrusted Word files from email and downloads.
- Verify the fixed build numbers in the MSRC advisory before finalising patch compliance.
- Check whether the Preview Pane is an attack vector in the MSRC FAQ and adjust settings if so.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide (MSRC advisory) msrc.microsoft.com
- Aggregator: affected versions and CVSS (Strix) www.strix.ai
- Microsoft November 2026 Patch Tuesday roundup (Cybersecurity News) cybersecuritynews.com
- Patch Tuesday listing with severity (NewsBeep) www.newsbeep.com
- November 2026 security update review (Zero Day Initiative) www.zerodayinitiative.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:43.
Original description (NVD)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.