CVE-2026-108438: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-108438) involves a use-after-free condition in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. Exploitation could lead to unauthorized information disclosure over a network. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, no privileges, and user interaction. Confidentiality impact is high, with no integrity or availability impact. Microsoft has published an official fix for affected versions, and the vulnerability is tracked in their security update guide.

An attacker can exploit this use-after-free vulnerability remotely to disclose sensitive information without requiring privileges. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the security updates provided by Microsoft for Microsoft 365 Apps for Enterprise to remediate this issue. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted components; however, local client updates are necessary to fully mitigate the risk.