Microsoft Office CVE-2026-55018

Exploitation requires a user to open an attacker-supplied malicious Office document (UI:R in the CVSS vector) on an affected Office build; the attacker needs no prior authentication or privileges on the target (PR:N), and the attack executes locally through the document rather than over the network (AV:L). Limiting factors: the mandatory user interaction means the victim must actually open the file and, for internet- or email-sourced documents, would typically need to dismiss Protected View / enable editing before the vulnerable code path is fully reachable, which substantially constrains mass exploitation. The bug affects both Windows and macOS Office builds listed in the CPE data, so platform is not a limiting factor, but only the enumerated Office versions are impacted.

The signals point to a realistic but not emergency-grade risk. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8) reflects local attack vector with mandatory user interaction - the 'local' vector here means execution flows through a document the user must open, not remote network delivery, which materially lowers exploitability versus a wormable network bug. No EPSS score was supplied, and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation; likewise no POC is referenced, meaning no public exploit is identified at time of analysis. The high triple-impact (C:H/I:H/A:H) shows full compromise of the user context is possible once exploited, and Office's enormous install base makes it an attractive phishing target, but the requirement for user interaction and the absence of exploitation evidence place this in the 'patch on normal cadence' tier rather than 'drop everything.' Note the reported tags include 'Denial Of Service' alongside code execution - the description and CVSS (C:H/I:H) emphasize code execution, so the DoS tag likely reflects a secondary crash outcome; verify with the vendor advisory if DoS-only impact matters to your assessment.

An attacker emails or otherwise delivers a specially crafted Office document to a target and lures them into opening it (and, if applicable, exiting Protected View). Opening the file triggers the use-after-free, corrupting memory so the attacker's payload executes arbitrary code with the victim's privileges - typically the first foothold for credential theft or lateral movement. No public exploit is identified at time of analysis, so this reflects the plausible path given the AV:L/UI:R CVSS profile rather than an observed campaign.