Cyber Posture

CVE-2026-26113

High

Published: 10 March 2026

Published
10 March 2026
Modified
13 March 2026
KEV Added
Patch
CVSS Score 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0002 6.6th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-26113 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the untrusted pointer dereference vulnerability through timely patching of the affected Microsoft Office software.

prevent

Implements memory protection mechanisms like ASLR and DEP to prevent arbitrary code execution from untrusted pointer dereferences in Microsoft Office.

preventdetect

Deploys malicious code protection that can block or detect exploitation attempts targeting the pointer dereference flaw in Microsoft Office.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Local untrusted pointer dereference in Microsoft Office with no privileges or user interaction required directly enables arbitrary code execution, mapping to Exploitation for Privilege Escalation (T1068) and Exploitation for Client Execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.

Deeper analysisAI

CVE-2026-26113 is an untrusted pointer dereference vulnerability (CWE-822) affecting Microsoft Office. Published on 2026-03-10, it has a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and enables an unauthorized attacker to execute code locally.

An unauthorized local attacker can exploit this vulnerability with low attack complexity, requiring no privileges or user interaction. Successful exploitation grants the attacker the ability to execute arbitrary code on the affected system, with high impacts to confidentiality, integrity, and availability.

The Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26113 provides details on associated patches and mitigations.

Details

CWE(s)

Affected Products

microsoft
365 apps
all versions
microsoft
office
2016, 2019
microsoft
office long term servicing channel
2021, 2024
microsoft
sharepoint server
2016, 2019 · ≤ 16.0.19725.20076

CVEs Like This One

CVE-2026-20948Same product: Microsoft 365 Apps
CVE-2025-24083Same product: Microsoft 365 Apps
CVE-2025-21354Same product: Microsoft 365 Apps
CVE-2026-20955Same product: Microsoft 365 Apps
CVE-2026-20953Same product: Microsoft 365 Apps
CVE-2025-21363Same product: Microsoft 365 Apps
CVE-2025-21381Same product: Microsoft 365 Apps
CVE-2026-20956Same product: Microsoft 365 Apps
CVE-2026-26112Same product: Microsoft 365 Apps
CVE-2025-54910Same product: Microsoft 365 Apps

References