Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. This vulnerability, identified as CWE‑416, means the Office application may run arbitrary code when a freed memory region is accessed, potentially enabling an attacker to take control of the system from a local user context.

Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Microsoft Office for Android.

Based on the revised description, the attacker can trigger the use‑after‑free during normal Office application operations, such as opening a crafted workbook or document. Once the condition is met, arbitrary code can run with the privileges of the user running Office. The CVSS score of 8.4 demonstrates high severity, while an EPSS score below 1% and absence from the KEV catalog suggest a low exploitation likelihood. Prompt application of the vendor patch remains the priority to prevent exploitation.