CVE-2026-108438: Microsoft 365 Apps Use-After-Free Flaw

CVE-2026-108438 Overview

CVE-2026-108438 is a use-after-free vulnerability [CWE-416] in Microsoft Office Word that allows an unauthorized attacker to disclose information over a network. The flaw affects multiple Microsoft Office product lines, including Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021 for macOS, and Office LTSC 2024 for macOS. Exploitation requires user interaction, typically by convincing a victim to open a crafted document. Successful exploitation enables an attacker to read sensitive memory contents from the Word process, which may contain document data, authentication artifacts, or other application state.

Critical Impact
An attacker who exploits CVE-2026-108438 can read sensitive information from the Microsoft Word process memory on a victim system, with no authentication required beyond user interaction with a malicious file.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office LTSC 2021 for macOS
Microsoft Office LTSC 2024 for macOS

Discovery Timeline

2026-10-15 - CVE-2026-108438 published to the National Vulnerability Database (NVD)
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-108438

Vulnerability Analysis

The vulnerability is a use-after-free condition in Microsoft Office Word. A use-after-free occurs when a program continues to reference memory after it has been released back to the allocator. If an attacker can influence what is placed into the freed memory region before the dangling reference is used, the application reads attacker-influenced or residual data. In this case, the result is information disclosure rather than code execution, which aligns with the confidentiality-only impact profile defined for this CVE.

The attack vector is Network, but user interaction is required. In practice this means delivery through a crafted Word document hosted on a remote resource, delivered via email, or served through a web link. When Word parses the malicious content, the flawed object lifecycle leaks memory contents accessible to the Word process.

The EPSS score for this issue is 0.503%, placing it in the 42nd percentile of exploitation likelihood. No public exploit code or CISA KEV listing exists at the time of publication.

Root Cause

The underlying defect is improper object lifetime management within Word's document parsing or rendering path. An object reference is retained and later dereferenced after the backing allocation has been freed, exposing stale heap contents to attacker-controlled parsing logic.

Attack Vector

An attacker crafts a malicious Word document that triggers the vulnerable code path during opening or rendering. The attacker delivers the document over the network through phishing email, a shared link, or a compromised website. When the victim opens the file, the use-after-free is triggered and sensitive memory contents are exposed back to attacker-controlled document structures or scripting.

No verified public exploit code is available for CVE-2026-108438. See the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-108438

Indicators of Compromise

Word process (WINWORD.EXE on Windows, Microsoft Word on macOS) crashes or exceptions shortly after opening a document from an untrusted source
Word process spawning unexpected child processes or initiating outbound network connections after opening a document
Office documents arriving from external senders with embedded objects, unusual OLE structures, or malformed XML parts

Detection Strategies

Hunt for anomalous Word telemetry: unexpected memory access patterns, repeated access violations, or atypical module loads inside the Word process
Correlate email gateway logs with endpoint document-open events to identify delivery of suspicious .doc, .docx, or .rtf files to users
Inspect Office documents at the mail or web proxy layer for malformed structures that may trigger parser faults

Monitoring Recommendations

Monitor Office application crash events (Windows Error Reporting, macOS crash reports) centrally for spikes correlated with specific senders or document hashes
Track outbound network connections initiated by Office processes and alert on connections to unknown destinations
Enable and ingest Microsoft Defender for Office 365 or equivalent attachment-detonation telemetry into your SIEM for correlation

How to Mitigate CVE-2026-108438

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Update Guide across all affected Office installations
Inventory endpoints running Microsoft 365 Apps, Microsoft 365 for macOS, Office LTSC 2021 for macOS, and Office LTSC 2024 for macOS, and prioritize patching
Reinforce user guidance on opening Office documents from unknown or untrusted senders

Patch Information

Microsoft has published remediation guidance in the Microsoft Security Update Guide for CVE-2026-108438. Administrators should ensure Click-to-Run channels for Microsoft 365 Apps are current and that macOS Office builds are updated through Microsoft AutoUpdate.

Workarounds

Enforce Protected View for documents originating from the internet and from Outlook attachments to limit exposure of the vulnerable parser
Use Group Policy or Office cloud policy to block macros and OLE object activation from untrusted locations
Route inbound Office attachments through a sandbox or attachment-detonation service before delivery to end users

bash

# Example: enforce Protected View for files originating from the internet (Windows registry)
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f