CVE-2026-26107
Published: 10 March 2026
Summary
CVE-2026-26107 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 20.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of system flaws like this use-after-free vulnerability in Excel via patching as recommended by MSRC.
Implements memory protection mechanisms such as ASLR and DEP that directly mitigate use-after-free exploits by preventing unauthorized memory access and code execution.
Deploys malicious code protection tools to scan for and block arbitrary code execution resulting from exploitation of the Excel vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free RCE in Excel triggered by opening a crafted file directly enables client-side exploitation (T1203) and requires user execution of a malicious file (T1204.002).
NVD Description
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Deeper analysisAI
CVE-2026-26107 is a use-after-free vulnerability (CWE-416) affecting Microsoft Office Excel. Published on 2026-03-10T18:18:38.820, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw allows an unauthorized attacker to execute code locally through improper memory handling in Excel.
An unauthorized attacker with local access to the target system can exploit this vulnerability. Exploitation requires low complexity and user interaction, such as convincing the user to open a malicious Excel file. Successful exploitation enables arbitrary code execution in the context of the user, resulting in high impacts to confidentiality, integrity, and availability.
The Microsoft Security Response Center (MSRC) has published an update guide detailing patches and mitigation recommendations at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26107.
Details
- CWE(s)