CVE-2026-47290 Overview
CVE-2026-47290 is a use-after-free vulnerability [CWE-416] in Microsoft Office that allows an unauthorized attacker to execute arbitrary code locally on affected systems. The flaw resides in memory management routines within the Office suite and can be triggered when a user opens a specially crafted document. Successful exploitation grants the attacker code execution in the context of the current user, enabling installation of programs, data theft, or account manipulation. Microsoft has published a security advisory covering the vulnerability across Microsoft 365 Apps and Office 2016, 2019, 2021, and 2024.
Critical Impact
Attackers can achieve local code execution in the context of the logged-on user by convincing a victim to open a malicious Office document, with impact on confidentiality, integrity, and availability.
Affected Products
- Microsoft 365 Apps (x64 and x86, Enterprise)
- Microsoft Office 2016 and Microsoft Office 2019 (x64 and x86)
- Microsoft Office LTSC 2021 and Microsoft Office LTSC 2024 (x64 and x86)
Discovery Timeline
- 2026-07-14 - CVE-2026-47290 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-47290
Vulnerability Analysis
The vulnerability is a use-after-free condition within Microsoft Office. Use-after-free flaws occur when an application continues to reference memory after it has been released, allowing an attacker to place controlled data at the freed location. When Office subsequently accesses that stale pointer, execution can be redirected to attacker-controlled code.
Because the attack vector is local and requires user interaction, a typical exploitation chain involves delivering a weaponized Office document by email, chat, or web download. Opening the document in a vulnerable Office application triggers the flawed code path and yields code execution with the privileges of the current user.
Root Cause
The root cause is improper object lifetime management within Office document parsing or rendering logic. A specific object is freed while a reference to it remains reachable, and later dereference of that pointer leads to memory corruption that can be shaped into control-flow hijacking.
Attack Vector
Exploitation requires the victim to open a malicious file. The attacker crafts a document that manipulates the vulnerable object lifecycle, triggers the free, reclaims the freed memory with attacker-controlled content, and forces Office to dereference the dangling pointer. No prior authentication is required, but user interaction is mandatory. Refer to the Microsoft CVE-2026-47290 Advisory for vendor-provided technical detail.
No public proof-of-concept code or in-the-wild exploitation has been reported at the time of publication.
Detection Methods for CVE-2026-47290
Indicators of Compromise
- Unexpected child processes spawned by winword.exe, excel.exe, or powerpnt.exe, such as cmd.exe, powershell.exe, mshta.exe, or rundll32.exe.
- Office applications crashing repeatedly with access-violation exceptions when opening specific documents delivered from external sources.
- Creation of executables, scripts, or LNK files in user-writable paths (%APPDATA%, %TEMP%, %PUBLIC%) shortly after a document is opened.
Detection Strategies
- Alert on Office process trees that deviate from normal behavior, especially process injection or outbound network connections initiated by Office binaries.
- Inspect inbound email attachments and shared documents for embedded objects, malformed structures, and unusual macros or ActiveX controls.
- Correlate document open events with subsequent file writes and registry modifications under user hives.
Monitoring Recommendations
- Enable Microsoft Defender attack surface reduction rules that block Office applications from creating child processes and injecting into other processes.
- Forward Sysmon process creation, image load, and file create events from endpoints running Office into a central analytics platform for behavioral analysis.
- Monitor for crash telemetry (WerFault.exe) referencing Office modules, which can indicate exploitation attempts or unstable payloads.
How to Mitigate CVE-2026-47290
Immediate Actions Required
- Apply the security updates referenced in the Microsoft CVE-2026-47290 Advisory to all affected Microsoft 365 Apps and Office 2016, 2019, 2021, and 2024 installations.
- Prioritize patching endpoints belonging to high-risk users such as executives, finance, HR, and IT administrators, who receive external documents frequently.
- Verify that Microsoft Update or your enterprise patch management workflow has successfully installed the fix and reboot systems where required.
Patch Information
Microsoft has released updates addressing CVE-2026-47290. Consult the Microsoft CVE-2026-47290 Advisory for the exact build numbers and update packages that apply to each supported version of Microsoft 365 Apps and Office LTSC.
Workarounds
- Enable Protected View and Office Application Guard so that documents originating from the internet or email attachments open in an isolated container.
- Configure Group Policy to block macros and ActiveX in documents from the internet, and enforce the Mark-of-the-Web on downloaded files.
- Instruct users to avoid opening unexpected Office attachments and to report suspicious documents to the security team before opening them.
# Example Group Policy registry keys to reduce Office document risk
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security" /v BlockContentExecutionFromInternet /t REG_DWORD /d 1 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
