CVE-2026-20950
Published: 13 January 2026
Summary
CVE-2026-20950 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 7.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the use-after-free vulnerability in Microsoft Office Excel through timely patching as advised by the Microsoft Security Response Center.
Implements memory protection safeguards such as DEP and ASLR to prevent unauthorized code execution from use-after-free exploits in Excel.
Deploys malicious code protection mechanisms to scan and block malicious Excel files exploiting the use-after-free vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Excel enables client-side code execution via malicious file opened by user (T1203 Exploitation for Client Execution + T1204.002 Malicious File).
NVD Description
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Deeper analysisAI
CVE-2026-20950 is a use-after-free vulnerability (CWE-416) in Microsoft Office Excel. Published on 2026-01-13, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw allows an unauthorized attacker to execute code locally by exploiting memory management errors in Excel.
An attacker requires local access to the target system and must trick a user into performing an action, such as opening a malicious Excel file, due to the low attack complexity and user interaction requirement. No privileges are needed (PR:N). Successful exploitation grants high-impact arbitrary code execution with full control over confidentiality, integrity, and availability on the local machine.
For mitigation details and patches, refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20950.
Details
- CWE(s)