Microsoft Office CVE-2026-55028

Exploitation requires the targeted user to locally open a specially crafted Office document with an affected application (UI:R is required per the CVSS vector). The attacker must deliver the malicious file to the victim's machine - typically via phishing email, drive-by download, or shared network storage - and induce the user to open it. No elevated privileges are required from the attacker's perspective (PR:N per CVSS vector), but the victim's machine must be running an unpatched version of an affected product per the CPE and EUVD version data. Both Windows and macOS builds are affected. Exploitation is not automatable (SSVC: Automatable=no) and cannot proceed without active user interaction. There is no evidence from the description, CVSS vector, or SSVC data that server-side or network-accessible SharePoint document processing constitutes an exploitation path without user involvement - the local file-open interaction is the triggering condition. Limiting factors for defenders include the UI:R requirement and the absence of any network-facing exploitation vector.

All available signals converge on a moderate, non-urgent risk profile. The CVSS 5.5 score with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N correctly conveys High confidentiality impact but constrains reach to local, user-triggered exploitation. EPSS at 0.39% (31st percentile) indicates very low probability of exploitation in the wild within the next 30 days, consistent with the absence of a KEV listing. CISA SSVC independently corroborates this: Exploitation=none, Automatable=no, Technical Impact=partial. The Automatable=no finding aligns with the UI:R requirement - mass exploitation without user interaction is not viable. No signal conflicts were identified between the CVSS vector and the description; both indicate a local file-open scenario. The primary real-world concern is use of this flaw as an information-leak primitive in a multi-stage attack chain - out-of-bounds reads can expose memory layout or sensitive in-memory data that facilitates a follow-on memory-corruption exploit. The wide product footprint (eleven CPE entries spanning six years of Office releases plus SharePoint) increases aggregate exposure across enterprise environments, even though the per-system exploitation probability remains low.

An attacker crafts a malicious Office document - such as a Word .docx or Excel .xlsx file - embedding a malformed record with an attacker-controlled size or offset value that causes the Office parser to read beyond the allocated buffer boundary. The file is delivered to the target via email attachment or a download link; when the target opens the document locally, the out-of-bounds read exposes adjacent memory contents, which could include sensitive application data or memory layout information usable as a stepping stone in a multi-stage attack. No public exploit code has been identified at time of analysis.