Microsoft Office CVE-2026-55042

Exploitation requires that the victim open or interact with a specially crafted Office document on a system running an affected Office version (Office 2016 through LTSC 2024, or any supported 365 Apps for Enterprise release on Windows or macOS). The CVSS vector AV:L confirms the attack is local - meaning the crafted file must be present and opened on the victim's own machine, not exploitable remotely without a delivery step. UI:R confirms passive delivery alone is insufficient; the user must actively open or render the document. PR:N indicates the attacker need not hold any privileges on the victim system prior to document delivery. Limiting factors: the requirement for user interaction blocks automated or worm-style exploitation; the local vector means a network-only attacker must first achieve file delivery (e.g., phishing, malicious download, shared drive). Non-default configurations or specific Office features are not identified in available data as required prerequisites.

The CVSS 3.1 base score of 5.5 (Medium) reflects a local attack vector (AV:L) requiring user interaction (UI:R), which substantially constrains the exploitability compared to network-reachable vulnerabilities. The High confidentiality impact (C:H) is significant - uninitialized memory leaks can expose sensitive process data - but the absence of integrity or availability impact (I:N/A:N) limits the standalone damage. SSVC reinforces a lower priority: Exploitation status is 'none' (no active exploitation observed), the attack is not automatable (UI:R eliminates worm-like propagation), and Technical Impact is rated 'partial'. No CISA KEV listing and no POC availability further reduce urgency. The primary real-world risk is targeted phishing scenarios where a user is socially engineered into opening a crafted Office document, making this a meaningful but non-emergency patching priority for organizations with controlled deployment pipelines.

An attacker crafts a malicious Office document specifically designed to trigger an uninitialized buffer read during parsing, then delivers it to a target via spear-phishing email or a compromised file share. When the victim opens the document in any affected Office version, the application processes the crafted content, reads uninitialized memory, and potentially exposes sensitive data - such as cached credentials, encryption keys, or other process-resident secrets - to the attacker through a secondary channel embedded in document metadata or a callback mechanism. No public exploit code exists at time of analysis, so exploitation requires bespoke development effort.