CVE-2026-80080: Microsoft 365 Apps Use After Free Flaw

CVE-2026-80080 Overview

CVE-2026-80080 is a double free vulnerability [CWE-415] in Microsoft Office Word that allows an unauthenticated attacker to execute arbitrary code over a network. The flaw affects multiple Office product lines on both Windows and macOS. Exploitation requires user interaction, typically opening a crafted Word document delivered through email, web download, or a shared file location. Successful exploitation yields code execution in the context of the current user.

Critical Impact
An attacker can achieve remote code execution on target systems when a user opens a malicious Word document, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (Windows and macOS)
Microsoft Word 2016 and Microsoft 365 for macOS

Discovery Timeline

2026-09-08 - CVE-2026-80080 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80080

Vulnerability Analysis

The vulnerability is a double free condition in Microsoft Office Word's document parsing logic. A double free occurs when the same heap allocation is released twice, corrupting allocator metadata. Attackers can leverage this corruption to manipulate heap structures and hijack control flow. Because Word processes complex document formats with numerous nested objects, memory management errors in these code paths are directly reachable from attacker-controlled input.

Exploitation results in arbitrary code execution under the privileges of the user running Word. Combined with common phishing delivery, this vulnerability provides a reliable initial access vector for network intrusions. The attack complexity is low and no prior authentication is required, though the victim must open the malicious document.

Root Cause

The root cause is improper tracking of heap allocations during Word document processing, classified as [CWE-415: Double Free]. When a specific object lifecycle is mishandled, free() is invoked twice against the same pointer. The second free corrupts allocator bookkeeping structures and enables an attacker to influence subsequent allocations.

Attack Vector

The attack vector is network-based delivery of a specially crafted .doc or .docx file. Common delivery mechanisms include phishing email attachments, malicious links in messaging platforms, and files hosted on SharePoint or other collaboration services. Protected View may mitigate direct exploitation, but users who click "Enable Editing" expose themselves to the vulnerable parser.

No public proof-of-concept exploit code is available at this time. Refer to the Microsoft CVE-2026-80080 Advisory for authoritative technical details.

Detection Methods for CVE-2026-80080

Indicators of Compromise

Word documents originating from untrusted external senders that trigger WINWORD.EXE crashes or unexpected child processes.
WINWORD.EXE spawning cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe.
Outbound network connections initiated by WINWORD.EXE to previously unseen hosts shortly after document open.
New persistence artifacts such as Run keys, scheduled tasks, or Startup folder entries created immediately after a Word session.

Detection Strategies

Deploy behavioral detection rules that flag Office applications launching scripting interpreters or LOLBins.
Enable Windows Defender Exploit Guard Attack Surface Reduction rules that block Office child process creation.
Correlate Word crash events (Application Error 1000 referencing winword.exe) with recent inbound email attachments.
Hunt for anomalous heap-related exceptions and memory corruption crashes within Office telemetry.

Monitoring Recommendations

Ingest email gateway logs, endpoint process telemetry, and Office application logs into a centralized analytics platform.
Monitor for high-risk file types (.doc, .docx, .rtf, .dotm) delivered via email or downloaded from external sources.
Alert on WINWORD.EXE spawning any process outside a defined allowlist.
Track patch deployment status across all Office installations and prioritize unpatched hosts for enhanced monitoring.

How to Mitigate CVE-2026-80080

Immediate Actions Required

Apply the Microsoft security updates for all affected Office channels as documented in the Microsoft CVE-2026-80080 Advisory.
Inventory all Windows and macOS endpoints running Microsoft 365 Apps, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016.
Enforce Protected View and block macros from files originating from the internet through Group Policy.
Educate users to avoid enabling editing on unsolicited Word documents.

Patch Information

Microsoft has published fixes through its standard security update channels. Windows customers should apply updates via Microsoft Update, WSUS, or Intune. Microsoft 365 Apps receives updates through Click-to-Run. macOS users should update through the Microsoft AutoUpdate tool. Consult the Microsoft CVE-2026-80080 Advisory for specific build numbers per channel.

Workarounds

Enable Attack Surface Reduction rule D4F940AB-401B-4EFC-AADC-AD5F3C50688A to block Office applications from creating child processes.
Configure Group Policy to open Office files from the internet in Protected View and disable macro execution from untrusted locations.
Use email gateway policies to strip or quarantine Office attachments from external senders pending patch deployment.
Restrict opening of Office documents received from untrusted sources on high-value endpoints until updates are applied.

bash

# Configuration example: enable ASR rule to block Office child process creation
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled