CVE-2026-23657 Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally

Description

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Affected products and versions

Product	Affected versions	Fixed in
Microsoft 365 Apps for Enterprise 16.0	16.0.1 → latest	No fix stated
Microsoft Office LTSC 2024 16.0	16.0.0 → latest	No fix stated

Other CVEs of Microsoft 365 Apps for Enterprise

The 931 CVEs of Microsoft 365 Apps for Enterprise →

CVE-2026-108454 Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network 6.5 Medium CVE-2026-108455 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network 6.5 Medium CVE-2026-108453 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network 6.5 Medium CVE-2026-108450 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network 8.8 High