CVE-2026-47290 Details

A use-after-free vulnerability has been identified in Microsoft Office, allowing an unauthorized attacker to execute code locally. This vulnerability affects multiple versions of Microsoft Office, including Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. The vulnerability arises from improper memory management, which can be exploited by sending a malicious Office file to a user and convincing them to open it.

Users can download the security update for this vulnerability through the Microsoft Update Catalog. For Microsoft Office 2016 (32-bit and 64-bit editions), the security update is available via the Microsoft Update Catalog. For Microsoft Office LTSC 2024 (both 32-bit and 64-bit editions), the security update can also be downloaded from the Microsoft Update Catalog. Microsoft 365 Apps for Enterprise users can find the security update through the Click to Run channel. For Microsoft Office 2019 (32-bit and 64-bit editions), the security update is available via the Microsoft Update Catalog.