Remote code execution via undisclosed use-after-free

Use-after-free in Microsoft Office allows remote attackers to execute code when a user interacts with malicious network content. Microsoft has not disclosed the freed object, the Office parsing path, or the operation that later dereferences the stale object. Exploitation is unauthenticated but requires user interaction; successful exploitation runs code in the affected Office process.