EUVD-2026-44158
GHSA-v986-mp4g-45cw
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened by a user (AV:L/UI:R) with no attacker privileges (PR:N); code runs in-process yielding full C/I/A impact within the user's unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office (365 Apps for Enterprise, Office 2016/2019, and Office LTSC 2021/2024) arises from a heap-based buffer overflow that an attacker triggers when a victim opens a maliciously crafted Office document. Successful exploitation yields full confidentiality, integrity, and availability impact in the context of the current user. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of Office and the low attack complexity make this a meaningful patch priority.
Technical ContextAI
The flaw is a CWE-122 heap-based buffer overflow, meaning Office allocates a buffer on the heap and writes past its bounds while parsing attacker-controlled data from a document file. Heap overflows corrupt adjacent allocations and heap metadata, which - with careful heap grooming - can be steered into control-flow hijacking and arbitrary code execution. The CPE data identifies the affected engine as the shared Office application code common to Microsoft 365 Apps for Enterprise (cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise), Microsoft Office 2016 and 2019, and Office LTSC 2021 and 2024; this shared file-parsing surface is why a single CVE spans both perpetual and click-to-run channels.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-55017 detailed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55017, ensuring Click-to-Run channels (Microsoft 365 Apps) auto-update and that MSI-based Office 2016/2019 and LTSC 2021/2024 installations receive the corresponding monthly update. The provided data does not enumerate exact fixed build numbers, so verify the target build against MSRC before validating remediation. As compensating controls until patching completes, enable Protected View and block macro/active content for files originating from the internet, and configure Office File Block or Group Policy to prevent opening untrusted document formats from email and web - trade-off is that legitimate documents in those formats will be blocked or opened read-only; additionally, use attack-surface-reduction rules and mail-gateway filtering to strip or sandbox risky Office attachments, at the cost of some workflow friction.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today