Use-after-free in Microsoft Office for macOS - CVE-2026-108438
Published: November 5, 2026
Vulnerability identifier: #VU159358
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-108438
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose portions of process memory.
The vulnerability exists due to use-after-free in Microsoft Office Word when processing attacker-controlled content. A remote attacker can induce a user to interact with specially crafted content to potentially read portions of process memory.
The Preview Pane is not an attack vector for this vulnerability.
Affected software
Microsoft Office for macOS
How to mitigate CVE-2026-108438
Install security update from vendor's website.
Microsoft Office for macOS - update to 16.114 26101123