Cyber Resilience

CVE-2026-32190

High

Published: 14 April 2026

Published
14 April 2026
Modified
17 April 2026
KEV Added
Patch
CVSS Score v3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0033 24.4th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-32190 is a high-severity Use After Free (CWE-416) vulnerability. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 24.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).

Deeper analysis

CVE-2026-32190 is a use-after-free vulnerability (CWE-416) affecting Microsoft Office. Published on 2026-04-14, it carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.

An unauthorized local attacker can exploit this vulnerability with low complexity and no user interaction required, as no privileges are needed (PR:N). Successful exploitation enables arbitrary code execution on the affected system.

Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32190 provides details on patches and mitigation steps for addressing this issue.

EU & UK References

Vulnerability details

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Use-after-free in Microsoft Office client app directly enables local arbitrary code execution (AV:L/PR:N/UI:N) via exploitation of client software vulnerability.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-1916Shared CWE-416
CVE-2025-0762Shared CWE-416
CVE-2026-7349Shared CWE-416
CVE-2026-3923Shared CWE-416
CVE-2026-25952Shared CWE-416
CVE-2026-7347Shared CWE-416
CVE-2026-7348Shared CWE-416
CVE-2026-32157Shared CWE-416
CVE-2026-34770Shared CWE-416
CVE-2025-11756Shared CWE-416

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Requires timely remediation of known flaws like this use-after-free vulnerability in Microsoft Office through vendor patches.

prevent

Implements memory protections such as DEP and ASLR that directly mitigate use-after-free exploits by preventing unauthorized code execution.

detect

Mandates vulnerability scanning to identify systems affected by CVE-2026-32190 in Microsoft Office.

References