Microsoft Office CVE-2026-55023

The CVSS vector (AV:L/UI:R/PR:N) requires that a victim actively opens or previews a crafted Office file on the local system - the vulnerability cannot be triggered remotely without this user interaction, and SSVC confirms it is not automatable. No elevated privileges are required by the victim (PR:N), but exploitation is bounded by: (1) mandatory local file interaction - the attacker cannot trigger the parse remotely without social engineering the user into opening the file; (2) the local attack vector (AV:L), meaning network-based unauthenticated exploitation against unmodified default configurations is not supported by the vendor's own scoring; (3) impact is strictly limited to information disclosure - no code execution, persistence, or availability impact. No special Office configuration or non-default feature needs to be enabled; the vulnerability exists in standard file parsing logic present across default installations. The presence of SharePoint in the CPE list introduces a potential server-side path where a document uploaded to SharePoint triggers parsing without end-user interaction - this would represent a different exploitation condition not fully resolved by available data.

Multiple independent signals converge on a low exploitation-priority assessment. CVSS 5.5 Medium reflects AV:L (local vector) and UI:R (required user interaction), materially constraining attacker reach and ruling out automated network exploitation. C:H indicates meaningful memory disclosure potential, but I:N and A:N bound total impact to confidentiality. EPSS at 0.51% (40th percentile) places this well below typical exploitation thresholds, and CISA SSVC confirms Exploitation: none and Automatable: no with only Partial Technical Impact. No KEV listing and no reported POC code are consistent with this posture. One signal worth flagging: the vendor's AV:L designation is somewhat atypical for a Microsoft Office file-parsing flaw - most Office document vulnerabilities are scored AV:N when delivered via email or web download. If the local vector reflects a specific constraint (e.g., file must reside locally before parsing can trigger the read), this further limits attacker reach. This is a genuine medium-priority issue warranting routine patch-cycle remediation but does not represent an emergency patching scenario absent KEV listing or POC emergence.

An attacker crafts a malicious Office document that embeds a file structure triggering an out-of-bounds read in the Office parser. The file is delivered to a target via spear-phishing email or a shared network location; the victim opens the file locally in a vulnerable Office version, causing the parser to read beyond a buffer boundary and expose adjacent memory contents - potentially including tokens, cached credentials, or sensitive document data - which could then be recovered by the attacker through a secondary exfiltration channel embedded in the file format.