CVE-2026-20952
Published: 13 January 2026
Summary
CVE-2026-20952 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 38.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-20952 is a use-after-free vulnerability (CWE-416) affecting Microsoft Office. Published on 2026-01-13, it carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and enables an unauthorized attacker to execute code locally.
An unauthorized attacker with local access to the affected system can exploit this vulnerability. Exploitation requires low complexity, no privileges, and no user interaction, allowing the attacker to achieve high impacts on confidentiality, integrity, and availability through local code execution.
Microsoft's update guide provides details on mitigations and patches for this vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20952.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2112
Vulnerability details
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Microsoft Office enables unauthenticated local code execution with no user interaction, mapping directly to client application exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation requires timely application of Microsoft patches to eliminate the use-after-free vulnerability in Office, directly preventing local code execution.
Memory protection implements safeguards like DEP and ASLR to block unauthorized code execution from use-after-free exploits in Microsoft Office.
Malicious code protection scans for and blocks exploit payloads targeting the use-after-free vulnerability during local execution attempts.