High severity8.4NVD Advisory· Published Mar 10, 2026· Updated Jun 17, 2026
CVE-2026-26110
CVE-2026-26110
Description
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
Affected products
22cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*+ 7 more
- cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*
- cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*
- cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*
- cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*
- (no CPE)
- (no CPE)range: 16.0.1
- (no CPE)range: 16.0.1
- (no CPE)range: 16.0.0
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*+ 5 more
- cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*
- cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*
- cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:macos:*:*
- cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*
- cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*
- cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:macos:*:*
- Microsoft/Microsoft 365 Apps for Enterprisev5Range: 16.0.1
16.0.0+ 1 more
- (no CPE)range: 16.0.0
- (no CPE)range: 19.0.0
16.0.1+ 1 more
- (no CPE)range: 16.0.1
- (no CPE)range: 16.0.0
Patches
Vulnerability mechanics
References
1- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26110nvdVendor Advisory
News mentions
1- Microsoft Patch Tuesday, March 2026 EditionKrebs on Security · Mar 11, 2026