CVE-2026-78514: CWE-416: Use After Free in Microsoft Microsoft 365 Apps for Enterprise

This vulnerability (CVE-2026-78514) involves a use-after-free condition in Microsoft Office Word, part of Microsoft 365 Apps for Enterprise. An attacker can exploit this flaw to execute arbitrary code remotely without privileges, requiring user interaction. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Multiple version ranges of Microsoft 365 Apps for Enterprise are affected. Microsoft has issued an official fix and manages remediation for this cloud-hosted service. No active exploitation has been reported.

Successful exploitation allows remote code execution by an unauthorized attacker, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This can occur over a network and requires user interaction.

An official fix is available from Microsoft. Users and administrators should apply the latest updates for Microsoft 365 Apps for Enterprise as detailed in the Microsoft Security Response Center advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78514). Since this is a cloud service, Microsoft manages remediation server-side, but local client updates are recommended to ensure protection.