A critical use after free vulnerability in multiple versions of Microsoft Office could allow an unauthorized local attacker to achieve code execution.

This vulnerability is a use after free condition within the Microsoft Office suite. It allows an unauthorized attacker with local access to trigger memory corruption, resulting in the execution of code on the host system.

The ability for a local attacker to execute arbitrary code poses a significant risk to organizational integrity and data confidentiality. Successful exploitation could lead to full system compromise, unauthorized access to sensitive documents, and potential lateral movement within the network. Given the CVSS score of 7.8, this flaw represents a high-severity risk that requires immediate attention to prevent privilege escalation or data exfiltration.

Immediate Action: Apply the latest security updates provided by Microsoft in the official security release portal immediately.

Proactive Monitoring: Monitor endpoint logs for suspicious process spawning or unexpected application crashes that may indicate exploitation attempts.

Compensating Controls: Ensure that endpoint protection software is fully updated to detect and block malicious code execution patterns.

Public Exploit Available: Unknown

Organizations should prioritize the deployment of Microsoft security patches to all affected systems. Given the potential for total system impact, failure to remediate this vulnerability leaves endpoints exposed to local code execution attacks. Update cycles should be accelerated for all systems running the affected versions of Microsoft Office.