CVE-2026-70311: Microsoft Office Word Use After Free Flaw

CVE-2026-70311 Overview

CVE-2026-70311 is a use-after-free vulnerability [CWE-416] in Microsoft Office Word. An unauthorized attacker can execute arbitrary code locally after a target user opens a crafted document. The flaw carries a CVSS 3.1 base score of 7.8 and requires user interaction but no prior privileges. Microsoft published the advisory on August 11, 2026, and tracks the issue through its Security Response Center. The vulnerability affects the Word document parsing and rendering pipeline, where freed memory can be referenced and reused during document processing. Successful exploitation yields code execution in the context of the current user, enabling data theft, persistence, and lateral movement when combined with privilege escalation techniques.

Critical Impact
A crafted Word document delivered by email or web download can trigger memory corruption and execute attacker-controlled code in the user's security context.

Affected Products

Microsoft Office Word (see Microsoft CVE-2026-70311 Update for specific build ranges)
Microsoft 365 Apps deployments that include Word
Standalone and volume-licensed Office installations that include Word

Discovery Timeline

2026-08-11 - CVE-2026-70311 published to NVD
2026-08-11 - Microsoft releases security advisory
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-70311

Vulnerability Analysis

CVE-2026-70311 is a use-after-free condition in Microsoft Word. The application frees a heap object during document processing but retains a dangling pointer that later code paths dereference. When an attacker controls the layout or contents of the freed region through a crafted document, the reuse of that pointer redirects execution or corrupts adjacent state. The result is arbitrary code execution in the process context of Word, typically running as the interactive user.

The attack requires the victim to open a malicious file. Delivery paths include phishing attachments, documents hosted on file shares, and downloads from compromised web pages. Preview panes in some mail clients may also trigger the vulnerable code path, expanding the exploitation surface.

Root Cause

The root cause is improper object lifetime management [CWE-416] inside Word's document parsing components. A code path releases a heap allocation while another path still holds a reference to it. Subsequent operations on that reference read or write freed memory, producing exploitable memory corruption. Attackers commonly pair use-after-free primitives with heap grooming to place attacker-controlled data at the freed address before the reuse occurs.

Attack Vector

Exploitation is local and requires user interaction. An attacker crafts a Word document containing malformed structures that drive the vulnerable free-and-reuse sequence. The victim opens the document, and Word processes the malicious content, triggering the dangling-pointer dereference. Code execution runs at the privilege level of the user opening the file. See the Microsoft advisory for technical details as they become available.

No verified proof-of-concept code is publicly available at this time.
Refer to the Microsoft advisory for authoritative technical details.

Detection Methods for CVE-2026-70311

Indicators of Compromise

Word processes (WINWORD.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe
Unexpected outbound network connections initiated by WINWORD.EXE shortly after a document is opened
Crash artifacts or Windows Error Reporting entries referencing access violations inside Word modules
Newly created files or scheduled tasks written by WINWORD.EXE outside the user's document folders

Detection Strategies

Hunt for process lineage anomalies where WINWORD.EXE is the parent of scripting or living-off-the-land binaries.
Correlate document open events with subsequent file writes to startup, Temp, or AppData\Roaming locations.
Monitor for DLL loads from user-writable paths by the Word process, which can indicate side-loading after initial code execution.

Monitoring Recommendations

Ingest Microsoft-Windows-Sysmon process, image load, and network events into your SIEM and alert on Office-parented executions.
Enable Attack Surface Reduction (ASR) rule auditing for the rule blocking Office applications from creating child processes.
Track email gateway telemetry for .docx, .doc, and .rtf attachments from external senders and correlate with endpoint document open events.

How to Mitigate CVE-2026-70311

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory to all Word installations.
Prioritize patching for users with elevated privileges, developers, and any host reachable from external mail flows.
Verify Microsoft 365 Apps update channels are current and confirm build numbers post-deployment.

Patch Information

Microsoft has published fixed builds through the Security Update Guide. Consult the Microsoft CVE-2026-70311 Update page for the exact KB articles, affected versions, and remediation builds applicable to your channel (Current, Monthly Enterprise, or Semi-Annual Enterprise).

Workarounds

Enable Protected View and Application Guard for Office to open documents from the internet in an isolated container.
Enforce the Microsoft Defender ASR rule that blocks Office applications from creating child processes.
Block or quarantine inbound .doc, .docx, .rtf, and .docm attachments from untrusted senders at the mail gateway until patching completes.
Disable the Outlook reading pane in high-risk environments to reduce automatic document rendering.

bash

# Enable the ASR rule blocking Office child process creation (PowerShell, run as admin)
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled