CVE-2026-50467

Microsoft Office Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 38th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile38th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which Microsoft Office products and exact versions you have installed (Windows: “File → Account” and “About Office”; Mac: “Word/Excel → About Microsoft Office”).
If your Office matches any listed product, update to the fixed version for that product:
For “microsoft 365 apps” update using Microsoft Office security updates (fixed in https://aka.ms/OfficeSecurityReleases).
For “microsoft office” update to version 16.0.5561.1000.
For Microsoft Office 365 for Mac and Microsoft Office LTSC for Mac 2021 and 2024 update to 16.111.26071215.
After updating, verify the “About”/version screen shows the fixed build, and then remove/avoid the suspicious documents you received from untrusted sources.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

This is a Microsoft Office flaw that could let an attacker run code on your computer by tricking a user into opening a specially crafted file, so most small businesses should act now and update Office to the fixed versions.

CVE-2026-50467 is a use-after-free (CWE-416) flaw in Microsoft Office that enables remote code execution when an attacker delivers a malicious document and a user opens it (requires user interaction).

If you're affected

Full device compromise
Malware installation
Ransomware risk
Business disruption

What is it

Microsoft Office has a safety bug that can be abused after a special file is opened. If an attacker sends you that file and a user opens it, it can potentially allow the attacker to run code on the same computer—similar to how a “booby-trapped” attachment could bypass normal protections and install something harmful.

Who is affected

This matters if you use or manage Microsoft Office or Microsoft 365 Apps on any of the listed platforms/editions. It targets Office when a user opens a malicious document, so the risk increases with email phishing and untrusted file sharing.

This is relevant only if the vulnerable Office product/version is installed and a malicious file can be delivered to (and opened by) a user.

How urgent is it

Marked RED because this is a remote code execution vulnerability in widely used Microsoft Office products, meaning a successful attack can lead to full compromise of a workstation. A patch is available now, and the flaw’s trigger involves opening attacker-controlled files, which commonly happens through everyday business email and downloads.

What to do — in detail

Confirm exposure

Identify which Microsoft products you have from the affected list: microsoft 365 apps, microsoft office, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, microsoft 365, office 2016, office 2019, office 2021, office 2024.
Record the exact installed version/build:
- Windows: open any Office app (Word/Excel) → “File” → “Account” → view “About”/version.
- Mac: open Word/Excel → “Word/Excel” menu → “About Microsoft Word/Excel” (or “About Microsoft Office”).
Compare your build to the fixed versions below.

Patch (required)

microsoft 365 apps: update to the fixed release available via Microsoft’s Office security updates (see https://aka.ms/OfficeSecurityReleases).
microsoft office: update to 16.0.5561.1000.
Microsoft Office 365 for Mac: update to 16.111.26071215.
Microsoft Office LTSC for Mac 2021: update to 16.111.26071215.
Microsoft Office LTSC for Mac 2024: update to 16.111.26071215.

Verify

Re-check the Office “About” screen after updating.
Confirm the build/version shown matches one of the fixed versions above for your edition.

Temporary workaround (if patching is delayed)

Restrict opening files from unknown/untrusted senders and domains.
Keep users in “Protected View” when available (avoid bypassing file warnings).
Treat inbound Office attachments as high-risk: do not open them unless they are expected and verified.

What to monitor

Email and web-filter logs for Office attachments recently received.
Endpoint alerts for Office spawning unusual processes after document open.

Timeline

No CISA KEV due date was provided in the findings for this CVE.

Technical context

CVE-2026-50467 is a Microsoft Office remote code execution vulnerability involving a use-after-free condition (CWE-416). The trigger requires user interaction (a user opens a malicious Office document), consistent with the provided attack vector indicators (AV:L, UI:R).

Findings summary relevant to decision-making:

No KEV listing was found.
Public exploit code is not on record.
Press reports did not include a clear, dated “exploited in the wild” claim.
A fix is available through Microsoft’s Office security release channels.

Why it’s still treated as RED: Office is commonly exposed through routine email/file workflows, and remote code execution in a desktop productivity suite can quickly turn a single opened document into full workstation compromise. The patch should be applied immediately rather than waiting for confirmed exploitation timelines.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS38th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 38th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 2 days, from the signal feeds we watch.

2026-07-16OpenVAS check addedpatch available, record updated
2026-07-15Record updatedrecord updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US
- Microsoft 365 Apps for EnterpriseDesktop AppConsumer Software / productivity
- microsoft 365SaaS ServiceSaaSCloud & SaaS / saas-application
- office 2016Desktop AppOn-premConsumer Software / productivity
- office 2019Desktop AppOn-premConsumer Software / productivity
- office 2021Desktop AppOn-premConsumer Software / productivity
- office 2024Desktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC 2021Desktop AppConsumer Software / productivity
- Microsoft Office 365 for MacDesktop AppOn-premConsumer Software / productivity

And 6 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable