EUVD-2026-44181
GHSA-65x2-ccc4-wp24
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
File-parsing flaw needs the victim to open a crafted document, so UI:R and AV:L; code runs as the current user (S:U) with full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps, and the macOS builds) stems from an out-of-bounds read in a file-parsing routine that lets a crafted document corrupt memory and run attacker-controlled code in the context of the current user. The same document-parsing components also affect SharePoint Enterprise Server 2016, SharePoint Server 2019, and the Subscription Edition. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis.
Technical ContextAI
The root cause is CWE-125 (out-of-bounds read): while parsing a malformed Office document, the code reads memory beyond the bounds of an allocated buffer. Although an OOB read most commonly yields information disclosure, Microsoft's advisory and the CVSS impact metrics indicate the condition is leverageable for code execution - typically because the mis-read data influences subsequent control-flow or pointer handling in the parser. The affected surface is the shared Office file-format parsing stack (Word/Excel/PowerPoint and related renderers) as reflected in the CPE set: microsoft_365_apps_for_enterprise, microsoft_office_2016, microsoft_office_2019, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, the Office 365/LTSC for Mac builds, plus SharePoint Enterprise Server 2016, SharePoint Server 2019, and Subscription Edition, which reuse the same document-processing libraries server-side.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55045 for your specific Office or SharePoint SKU; click-to-run/Microsoft 365 Apps builds update automatically while MSI-based Office 2016/2019/LTSC and SharePoint require deployment of the corresponding monthly cumulative update. Exact fixed version numbers are not provided in the input data, so confirm the correct build from the MSRC page before validating remediation. As compensating controls until patching completes, open untrusted documents in Protected View / Application Guard to sandbox the parser, block or quarantine Office file types (doc/docx/xls/xlsx/ppt/pptx and related) arriving from email and web at the gateway, and enable Attack Surface Reduction rules that restrict Office child-process creation - noting these controls can disrupt legitimate macro and embedded-content workflows. For SharePoint, restrict and monitor document upload/processing paths, accepting the operational overhead of tighter content controls.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today