Microsoft Office CVE-2026-55035

Exploitation requires that a victim user actively open or preview a specially crafted Office document on a system running one of the affected product versions listed in the CPE data. The CVSS vector UI:R confirms user interaction is mandatory - no exploitation occurs without this step. The local attack vector (AV:L) means the malicious document must be delivered to and opened on the victim's machine; remote, network-based exploitation without user action is not possible. No prior authentication or elevated privileges are required of the attacker (PR:N), but the attacker has no direct control over the vulnerable process. SSVC confirms the flaw is not automatable, ruling out mass scanning or drive-by exploitation. Exploitation is further limited to confidentiality impact only - the OOB read does not provide a write or code execution primitive, so post-exploitation impact is bounded by what memory contents happen to be adjacent to the vulnerable buffer at the time of the read.

All available signals converge on low real-world risk. The CVSS 3.3 Low score reflects the local attack vector (AV:L), mandatory user interaction (UI:R), and impact limited exclusively to low-severity confidentiality disclosure (C:L/I:N/A:N). EPSS of 0.51% at the 40th percentile is below average exploitation likelihood, consistent with zero reported active exploitation. SSVC confirms exploitation status as 'none,' automatable as 'no' (ruling out mass or worm-like attack scenarios), and technical impact as only 'partial.' The vulnerability is absent from CISA KEV. While the product footprint is exceptionally broad - spanning at least eleven distinct Microsoft product lines - the attack's dependency on user interaction and local delivery fundamentally caps its exploitation scalability. The information disclosure impact is inherently limited: an OOB read leaks a bounded quantity of process memory with no demonstrated path to privilege escalation or code execution. No conflicting signals are present; all data sources consistently place this as a low-priority, patch-when-convenient finding for most organizations.

An attacker crafts a malicious Office document - such as a .docx, .xlsx, or .pptx file - engineered to trigger an out-of-bounds read in a vulnerable Office parsing routine. The file is delivered to a target via phishing email or a compromised file share, and the victim opens it without recognizing the risk. Upon parsing, the vulnerable component reads beyond its allocated buffer, leaking a small region of adjacent Office process memory to the attacker, potentially exposing cached credentials, document content, or other sensitive in-memory data depending on memory layout at exploitation time.