CVE-2026-108446
published 2026-10-15CVE-2026-108446: Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
PriorityP356high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.43%
36.5th percentile
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_365_apps_for_enterprise | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_365_for_mac | >= 1.0.0 < 16.114.26101123 | 16.114.26101123 |
| microsoft | microsoft_office_ltsc_2021 | >= 16.0.1 < 16.0.14334.20974 | 16.0.14334.20974 |
| microsoft | microsoft_office_ltsc_2024 | >= 16.0.0 < 16.0.17932.21056 | 16.0.17932.21056 |
| microsoft | microsoft_office_ltsc_for_mac_2021 | >= 16.0.1 < 16.114.26101123 | 16.114.26101123 |
| microsoft | microsoft_office_ltsc_for_mac_2024 | >= 16.0.0 < 16.114.26101123 | 16.114.26101123 |
| microsoft | office_online_server | < 16.0.10417.20228 | 16.0.10417.20228 |
| microsoft | office_online_server | >= 16.0.0.0 < 16.0.10417.20228 | 16.0.10417.20228 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Microsoft 365 Apps for Enterprise use after free
vuldb·2026-10-15·CVSS 8.8
CVE-2026-108446 [HIGH] Microsoft 365 Apps for Enterprise use after free
A vulnerability was found in Microsoft 365 Apps for Enterprise, Office 365 for Mac, Office LTSC 2021, Office LTSC 2024, Office LTSC for Mac 2021, Office LTSC for Mac 2024 and Office Online Server. It has been classified as critical. This vulnerability affects unknown code. The manipulation leads to use after free.
This vulnerability is traded as CVE-2026-108446. It is possible to initiate the attack remotely. There is no exploit available.
It is suggested to install a patch to address this issue.
GHSA
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
ghsa_unreviewed·2026-10-15
CVE-2026-108446 [HIGH] CWE-416 Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-15
Published