Untrusted Pointer Dereference in Microsoft products - CVE-2026-26113

Vulnerability identifier: #VU123867

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-26113

CWE-ID: CWE-822

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to untrusted pointer dereference in Microsoft Office. A remote attacker can execute arbitrary code on the target system.

Microsoft 365 Apps for Enterprise
Microsoft Office
Microsoft Office LTSC
Microsoft SharePoint Enterprise Server
Microsoft SharePoint Server
Microsoft SharePoint Server Subscription Edition

Install updates from vendor's website.

Microsoft Office - update to 16.0.5543.1000
Microsoft SharePoint Enterprise Server - update to 16.0.5543.1000
Microsoft SharePoint Server - update to 16.0.10417.20102
Microsoft SharePoint Server Subscription Edition - update to 16.0.19725.20076

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26113

• Multiple vulnerabilities in Microsoft Office