CVE-2026-20952:

Use after free vulnerability in Microsoft Office enables local code execution.

Score
A numerical rating that indicates how dangerous this vulnerability is.

8.4High

Published Date:Jan 13, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.0
EPSS Percentile:7%

Exploitability

Score:2.5
Attack Vector:LOCAL
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Use after free vulnerability in Microsoft Office enables local code execution.

Overview

CVE-2026-20952 is a critical vulnerability affecting Microsoft Office. It stems from a use after free weakness (CWE-416), which occurs when the software incorrectly manages memory, potentially allowing an attacker to execute arbitrary code. The vulnerability has a CVSS v3.1 base score of 8.4, categorized as HIGH severity. It can be exploited locally with low attack complexity and without requiring privileges or user interaction. The potential impact is severe, with possible high-level compromise of system confidentiality, integrity, and availability.

Remediation

While specific remediation details are not provided in the CVE information, general best practices for addressing use after free vulnerabilities include:
1. Applying the latest security updates from Microsoft as soon as they become available.
2. Implementing robust memory management techniques in software development.
3. Utilizing address space layout randomization (ASLR) and data execution prevention (DEP) to mitigate potential exploits.
4. Employing endpoint detection and response (EDR) solutions to detect and prevent exploitation attempts.
5. Restricting user permissions and implementing the principle of least privilege to limit potential damage from successful exploits.
Organizations should monitor Microsoft's security advisories for official patch information and follow their guidance for addressing this vulnerability.