CVE-2026-55007: CWE-415: Double Free in Microsoft Microsoft Exchange Server 2019 Cumulative Update 14

This vulnerability, identified as CWE-415 (Double Free), exists in Microsoft Exchange Server 2019 Cumulative Update 14. It allows an attacker without privileges to execute arbitrary code remotely by exploiting a double free memory management error. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality, integrity, and availability. Microsoft has published an official fix addressing this issue. The affected versions are those with build numbers >=15.02.0.0 but less than 15.02.1544.046, 15.02.1748.051, and 15.02.2562.049 respectively, as specified in the affectedVersions field.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code remotely on the affected Microsoft Exchange Server 2019 installations. This compromises confidentiality, integrity, and availability of the system. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Administrators should apply the security update for Microsoft Exchange Server 2019 Cumulative Update 14 as detailed in the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55007. No additional mitigation steps are indicated beyond applying the official patch.