CVE-2026-20953CWE-416

Microsoft Office Remote Code Execution Vulnerability

High · published January 13, 2026

CVSS v3.1
8.4
EPSS
1%
Percentile
46.6
In the wild
Unconfirmed
What it is

⚡ A crafty use-after-free bug in Microsoft Office could let unauthorized attackers run code locally, like a ghost slipping into your house unnoticed! 👻 Think of it like a restaurant where a table is still reserved for a customer who already left. The staff could mistakenly serve someone else at that table, leading to a mix-up of orders, and in this case, a potential code execution! An attacker could exploit this vulnerability to execute arbitrary code on your system, gaining the ability to manipulate files, steal sensitive data, or even spread malware. It’s a bit like leaving your front door wide open, inviting unwanted guests into your personal space!

Put simply

Think of it like a restaurant where a table is still reserved for a customer who already left. The staff could mistakenly serve someone else at that table, leading to a mix-up of orders, and in this case, a potential code execution! This use-after-free vulnerability occurs when Microsoft Office improperly manages memory, allowing an attacker to access previously freed resources, leading to potential code execution. It's a sneaky bug that can be triggered through malicious documents.

What to do

An attacker could exploit this vulnerability to execute arbitrary code on your system, gaining the ability to manipulate files, steal sensitive data, or even spread malware. It’s a bit like leaving your front door wide open, inviting unwanted guests into your personal space! To protect yourself, ensure you're using the latest versions of Microsoft Office by applying the most recent patches. Regularly check for updates and consider implementing application whitelisting to limit what can run on your systems. 🛡️ You've got this! By staying vigilant and proactive, you can secure your digital environment and keep those pesky ghosts out! 🎉

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00574 · 46.6th percentile
Weakness
CWE-416 · Use After Free
Published
2026-01-13T17:56Z
EPSS history
Timeline
  • 13 JAN 17:56Z
    Microsoft Office Remote Code Execution Vulnerability
    cvelistv5