CVE-2026-35436
High · 8.8CVSS
8.8
EPSS
0.2%
Published
May 12, 2026
CISA due date
—
The record
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-57202 Asterisk is an open source private branch exchange and telephony toolkit. CWE-1220
- CVE-2026-96372 Insufficient Granularity of Access Control vulnerability in Drupal Webform allows… CWE-1220
- CVE-2026-83499 Insufficient granularity of access control in Windows Server Update Service allows an… CWE-1220
- CVE-2026-81969 Insufficient granularity of access control in Windows Server Update Service allows an… CWE-1220
- CVE-2026-70216 Insufficient granularity of access control in Windows Mobile Device Management allows an… CWE-1220
- CVE-2026-70218 Insufficient granularity of access control in Windows StateRepository API allows an… CWE-1220
- CVE-2026-78230 AshAi exposes Ash read actions to language-model tool calls. CWE-1220
- CVE-2026-78216 AshLua exposes Ash read actions to Lua scripts run through an eval action. CWE-1220