Main Vulnerability Database Vulnerabilities #VU164766

Use-after-free in Microsoft Office for macOS and Microsoft Office - CVE-2026-110052

Published: November 10, 2026

Vulnerability identifier: #VU164766

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-110052

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on an affected system.

The vulnerability exists due to use-after-free in Microsoft Office Word when processing malicious input with user interaction. A remote attacker can supply crafted input that causes the application to access freed memory to execute arbitrary code.

Successful exploitation depends on specific application memory conditions that cannot be fully controlled, making exploitation unreliable.

Affected software

Microsoft Office for macOS
Microsoft Office

How to mitigate CVE-2026-110052

Install security update from vendor's website.

Microsoft Office for macOS - update to 16.115.26110837
Microsoft Office - addressed in versions 16.0.14334.21048, 16.0.17932.21140

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-110052

Related Security Bulletins