Microsoft Office Word Use-After-Free Vulnerability Allowing Local Remote Code Execution

A use-after-free vulnerability has been identified in Microsoft Office Word. This vulnerability allows an unauthorized attacker to execute code locally on the affected system. The issue arises from improper memory management, which can be exploited under certain conditions.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the affected system.

Remediation

Users can download the security update for this vulnerability through the Microsoft Update Catalog. For Microsoft Word 2016 (32-bit and 64-bit editions), the security update is available as part of the October 2025 security updates. Instructions for downloading the update can be found in the Microsoft Word 2016 Security Update Knowledge Base article. For Microsoft Office LTSC 2024 (32-bit and 64-bit editions), the security update is also part of the October 2025 security updates. Similar guidance applies to Microsoft Office LTSC 2021 (32-bit and 64-bit editions), Microsoft Office 2019 (32-bit and 64-bit editions), Microsoft 365 Apps for Enterprise (32-bit and 64-bit systems), and Microsoft SharePoint Server 2019 and SharePoint Enterprise Server 2016.