CVE-2026-77504: Microsoft Word Use-After-Free Vulnerability

CVE-2026-77504 Overview

CVE-2026-77504 is a double free vulnerability [CWE-415] in Microsoft Office Word that allows an unauthorized attacker to execute code over a network. The flaw stems from improper memory management when Word processes crafted document content. An attacker who convinces a user to open a malicious document can trigger memory corruption and execute arbitrary code in the context of the current user.

Critical Impact
Successful exploitation gives an unauthenticated remote attacker code execution on the target system after minimal user interaction, exposing confidentiality, integrity, and availability of the host.

Affected Products

Microsoft Office Word (per Microsoft Security Response Center advisory)
Refer to the Microsoft Vulnerability Update for the authoritative list of affected builds
Consult vendor guidance for Microsoft 365 Apps and standalone Office channels

Discovery Timeline

2026-09-08 - CVE-2026-77504 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-77504

Vulnerability Analysis

The vulnerability is a double free condition classified under [CWE-415]. A double free occurs when a program calls the memory deallocation routine twice on the same pointer without reassigning it between calls. The second free operation corrupts allocator metadata such as free list pointers or heap chunk headers.

An attacker who can influence subsequent allocations can steer freed memory back into a controlled state. This provides a primitive for arbitrary write or control-flow hijacking. In Microsoft Office Word, the parser handles complex object graphs across document formats, providing ample surface for crafting inputs that trigger the duplicate deallocation.

Exploitation requires the target user to open a specially crafted document, which aligns with the user-interaction requirement in the CVSS vector. Preview pane rendering may reduce the interaction bar for some Office configurations.

Root Cause

The root cause is improper tracking of ownership over a heap-allocated object during document processing. When two code paths both attempt to release the same allocation, the second free() corrupts allocator state. Microsoft has not published the affected component or function names publicly.

Attack Vector

The attack is network-delivered and typically manifests through email attachments, phishing links, SMB shares, or web downloads. The victim opens the crafted .doc, .docx, or .rtf file in Microsoft Office Word. Word parses the malicious structures, triggers the double free, and executes attacker-supplied shellcode in the user's security context.

No verified proof-of-concept code is publicly available. Technical details are described in prose per the Microsoft Vulnerability Update.

Detection Methods for CVE-2026-77504

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, including cmd.exe, powershell.exe, rundll32.exe, or mshta.exe
Word crashes with faulting module addresses in the heap manager, recorded in Windows Error Reporting
Outbound network connections initiated directly by WINWORD.EXE to uncategorized or newly registered domains
Suspicious documents delivered from external senders with macros disabled but embedded objects present

Detection Strategies

Hunt for anomalous process trees where Office applications launch scripting or LOLBin utilities
Correlate document open events with subsequent file writes to %APPDATA%, %TEMP%, or Startup folders
Inspect email gateway telemetry for Word documents containing malformed or unusually large embedded objects
Enable and monitor Windows Defender Exploit Guard Attack Surface Reduction rules that block Office child process creation

Monitoring Recommendations

Forward Sysmon Event IDs 1, 3, 7, and 11 from endpoints running Microsoft Office to a centralized SIEM
Alert on Office application crashes reported through Windows Error Reporting (Event ID 1000 in the Application log)
Track SMB and HTTP fetches of Office documents from external sources into user profile directories

How to Mitigate CVE-2026-77504

Immediate Actions Required

Apply the security update referenced in the Microsoft Vulnerability Update across all Office installations
Prioritize patching for users who routinely handle externally sourced documents
Verify Microsoft 365 Apps update channel configuration to confirm devices receive the fixed build

Patch Information

Microsoft has issued a security update through the Microsoft Security Response Center. Administrators should consult the Microsoft Vulnerability Update for the specific KB articles, affected builds, and remediation guidance for each Office channel and standalone SKU.

Workarounds

Enable Protected View for all documents originating from the internet, email attachments, and unsafe locations
Configure Attack Surface Reduction rule Block all Office applications from creating child processes (GUID D4F940AB-401B-4EFC-AAA1-A6D6E7B0F7B0)
Block or quarantine .doc, .docx, and .rtf attachments from untrusted senders at the email gateway
Disable the Outlook preview pane for external mail to reduce unattended rendering of malicious documents

bash

# Enable ASR rule to block Office child process creation via PowerShell
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AAA1-A6D6E7B0F7B0 `
                 -AttackSurfaceReductionRules_Actions Enabled

# Enforce Protected View for files from the internet
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" `
                 -Name "DisableInternetFilesInPV" -Value 0 -Type DWord