CVE-2026-108442

Overview

Microsoft Office Word contains a use‑after‑free vulnerability that can be triggered over a network, enabling an attacker to execute arbitrary code. The flaw is critical and can compromise any system running affected Word versions. It is a high‑risk threat for organizations that rely on Office for document processing.

Description

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Impact

The vulnerability can lead to loss of confidentiality, integrity, and availability of data on the target system. Attackers can gain full control of the affected machine, potentially spreading laterally across the network. End users and organizations using Office Word are directly impacted.

Remediation

Apply the latest Microsoft Office security update that addresses CVE‑2026‑108442. If immediate patching is not possible, restrict network access to Word files, enforce strict file‑type filtering, and disable macros or use Office’s Protected View. Monitor for anomalous outbound connections and consider network segmentation to limit lateral movement.

Risk context

The CVE is rated critical with a CVSS v3 score of 8.8, indicating a high likelihood of exploitation. No EPSS data is available, but the severity warrants urgent patching and defensive measures.

Affected products

• Microsoft Office Word 2023
• Microsoft Office Word 2021
• Microsoft Office Word 2019
• Microsoft Office Word 2016
• Microsoft Office Word 2013
• Microsoft Office Word 2010
• Microsoft Office Word 2007
• Microsoft Office Word 2003