Microsoft Office CVE-2026-55027

Exploitation requires that a victim user locally opens a specially crafted Office document on an affected installation, confirmed by CVSS metrics AV:L and UI:R. The attacker requires no privileges on the target system (PR:N) - only the ability to deliver a malicious file to the victim. Exploitation is bounded by: (1) mandatory user interaction - the file must be actively opened, not merely present on disk; (2) local attack surface - no network-reachable exploitation path exists; (3) impact limited to confidentiality with no integrity or availability consequence; and (4) Protected View or document trust policies, if enforced, would prevent the vulnerable parsing code from executing. There is no indication that specific non-default configuration settings are required beyond having an affected Office version installed.

The CVSS 3.1 base score of 5.5 (Medium) reflects a constrained threat profile: AV:L limits exploitation to file-based delivery, UI:R requires victim interaction, and the impact is purely confidentiality (C:H, I:N, A:N). Real-world exploitation signals are uniformly low - EPSS is 0.51% at the 40th percentile, CISA KEV does not list this CVE, and SSVC classifies exploitation as none, automatable as no, and technical impact as partial. These signals are internally consistent: this is a file-parser memory disclosure that requires social engineering to deliver the malicious document, is not easily automated at scale, and has limited impact confined to memory leakage. While C:H sounds alarming, the practical value of leaked memory contents depends heavily on what sensitive data resides in adjacent memory at the time of exploitation. Overall, this CVE does not warrant emergency prioritization but should be addressed in the next standard patch cycle given the ubiquitous deployment of Microsoft Office.

An attacker crafts a malicious Office document (e.g., a Word .docx or Excel .xlsx file) embedding content designed to trigger the out-of-bounds read in the document parser. The file is delivered to a target via phishing email or a compromised file share; when the victim opens it, the parser reads beyond the allocated buffer and exposes adjacent memory contents - potentially including authentication tokens, clipboard data, or other in-memory sensitive material. No public exploit code has been identified at time of analysis, and exploitation is not automatable at scale per SSVC assessment.