EUVD-2026-44173
GHSA-p3jg-x8jx-7h43
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local vector and low privileges required because exploitation needs an authenticated local session; confidentiality-only impact reflects pure information disclosure with no write or denial-of-service component.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Local information disclosure in Microsoft Office and SharePoint via an integer overflow (CWE-190) exposes sensitive data to low-privileged local attackers across a broad range of Office versions on both Windows and Mac platforms. The CVSS vector (AV:L/PR:L) confirms exploitation requires an existing foothold on the target machine, limiting real-world impact to post-compromise scenarios or insider threats. No active exploitation is confirmed by CISA KEV, and the EPSS score of 0.40% (32nd percentile) combined with SSVC exploitation status of 'none' indicates this is not currently being weaponized in the wild.
Technical ContextAI
CWE-190 (Integer Overflow or Wraparound) occurs when an arithmetic operation produces a result that exceeds the maximum value representable by the target data type, causing the value to wrap around to a small or negative number. In Microsoft Office and SharePoint components (CPE: cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise, microsoft_office_2016/2019, microsoft_office_ltsc_2021/2024, microsoft_office_365_for_mac, microsoft_sharepoint_enterprise_server_2016, microsoft_sharepoint_server_2019), this class of bug typically manifests in file parsing, memory allocation sizing calculations, or buffer indexing routines. When the overflow corrupts a size or index value, the application may subsequently read beyond intended memory boundaries, leaking sensitive in-process data. The scope is unchanged (S:U), indicating the overflow is contained within the affected Office process and does not cross privilege or isolation boundaries.
RemediationAI
The primary remediation is to apply the Microsoft-released security patches for each affected product. For Windows Office versions (2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise), the fixed builds are referenced at https://aka.ms/OfficeSecurityReleases via Microsoft Update or Microsoft 365 admin center. For macOS versions (Office 365 for Mac, LTSC for Mac 2021 and 2024), upgrade to build 16.111.26071215 or later via Microsoft AutoUpdate. For SharePoint Enterprise Server 2016, apply the cumulative update to build 16.0.5561.1001 or later; for SharePoint Server 2019, update to 16.0.10417.20175 or later; for SharePoint Server Subscription Edition, update to 16.0.19725.20434 or later. The authoritative patch guidance and download links are provided by Microsoft MSRC at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55026. If patching cannot be applied immediately, restricting local logon access to trusted users only limits exposure, though this is a compensating control and not a substitute for the patch.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today