Microsoft Word CVE-2026-55033

Exploitation requires the victim to open an attacker-supplied crafted Word-format document in an affected Office/SharePoint build - the UI:R metric means user interaction (opening the file) is mandatory, which is the primary limiting factor. No authentication or prior privileges on the target are needed (PR:N), and attack complexity is low (AC:L), so a single successful lure suffices; however, the AV:L vector means the malicious file must reach and be opened on the local machine rather than being exploitable remotely without interaction. Code executes only at the privilege level of the user who opens the document, not automatically as SYSTEM. For SharePoint server components, the same parser may process documents server-side, potentially reducing the human-open requirement - confirm against the Microsoft advisory.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a high-impact but user-interaction-gated flaw: no privileges are required, but the attacker cannot act purely over the network - a victim must open the malicious document, which is why the vector is AV:L with UI:R rather than a wormable AV:N. Full confidentiality, integrity, and availability impact reflect arbitrary code execution in the user's context. There is no EPSS score, no POC, and no KEV listing in the provided data, so exploitation probability signals are absent; this is a high-CVSS issue whose real-world urgency depends on Office's enormous install base rather than confirmed exploitation. Note a nuance for defenders: the SharePoint CPEs imply the same parser runs server-side, where a document processed without a human 'open' could weaken the practical value of the UI:R assumption for those specific deployments - verify SharePoint exposure with the vendor advisory. Overall: a real, patch-now priority driven by prevalence, but not evidenced as actively exploited.

An attacker crafts a malicious Word document that triggers the integer overflow during parsing and delivers it via phishing email, a shared drive, or a download link. When the victim opens the file, the wrapped size calculation causes memory corruption and the attacker's code executes with the victim's privileges. No public exploit is identified at time of analysis, so this reflects the expected path given the AV:L/UI:R vector rather than an observed campaign.