Microsoft Office CVE-2026-55026

Exploitation requires the attacker to hold a local, authenticated session on the target machine with at minimum low-level user privileges (PR:L per CVSS vector). The attack does not require elevated or administrative rights, but physical or remote shell access to the host is a prerequisite. No special Office configuration or non-default feature needs to be enabled - the vulnerability exists in standard Office or SharePoint processing routines accessible to any authenticated local user. Exploitation is NOT automatable (SSVC: automatable=no) and is NOT reachable over the network, ruling out unauthenticated remote exploitation. The primary limiting factor is the requirement for prior local access, which confines realistic exploitation to insider threat scenarios, post-compromise lateral movement, or shared-system environments.

The CVSS base score of 5.5 (Medium) accurately reflects the constrained impact of this vulnerability. The attack vector is local (AV:L), complexity is low (AC:L), and low user privileges are required (PR:L), meaning an attacker must already have a session on the target system to exploit this flaw - significantly reducing the attack surface compared to network-exploitable vulnerabilities. The confidentiality impact is rated High (C:H) with no integrity or availability impact, classifying this as a pure information disclosure issue. The EPSS score of 0.40% at the 32nd percentile is low, consistent with the SSVC assessment of exploitation=none and automatable=no. The combination of these signals - no KEV listing, low EPSS, SSVC exploitation=none, and local-only attack vector - positions this as a real but low-urgency patching priority. Organizations should patch during routine maintenance cycles rather than treating this as emergency response.

An attacker who has already gained low-privileged local access to a Windows or macOS machine running a vulnerable version of Microsoft Office or SharePoint crafts an operation - such as opening a specially structured file or triggering a specific processing routine - that causes an integer overflow in an internal Office component. The overflow corrupts a buffer size or index, causing the application to read memory outside its intended bounds and potentially exposing sensitive in-process data such as credentials, tokens, or document content from adjacent memory. No public exploit code has been identified at time of analysis.