CVE-2026-20953
Published: 13 January 2026
Summary
CVE-2026-20953 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely identification, reporting, and patching of the use-after-free vulnerability in Microsoft Office as detailed in the MSRC update guide.
Implements memory safeguards such as DEP and ASLR that directly mitigate exploitation of use-after-free vulnerabilities allowing local code execution.
Requires vulnerability scanning to identify the presence of CVE-2026-20953 in Microsoft Office systems for prompt remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
UAF in Office enables local arbitrary code execution (no privs/UI needed), directly mapping to client-side exploitation and local privilege escalation.
NVD Description
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Deeper analysisAI
CVE-2026-20953 is a use-after-free vulnerability (CWE-416) affecting Microsoft Office. Published on 2026-01-13T18:16:23.150, it carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact with relatively low barriers to exploitation.
The vulnerability can be exploited by an unauthorized local attacker requiring only local access to the target system. Exploitation involves low attack complexity and demands no user interaction or privileges. Successful exploitation enables arbitrary code execution locally, compromising confidentiality, integrity, and availability at a high level.
Mitigation guidance and patches are detailed in the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20953.
Details
- CWE(s)