EUVD-2026-44181
GHSA-65x2-ccc4-wp24
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Office document
-
DeliveryDeliver via email or upload
-
ExploitVictim opens file in Office
-
ExecutionTrigger out-of-bounds read in parser
-
PersistCorrupt memory to hijack control flow
-
ImpactExecute code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to process a specially crafted Microsoft Office document via the vulnerable parser - in practice the victim (or a SharePoint server) must open or ingest attacker-supplied content, so delivery through email attachment, download, or upload is the enabling condition. The CVSS vector lists PR:N and UI:N (unauthenticated, no interaction) with AV:L (local), but for an Office file-format bug this UI:N is inconsistent with real-world delivery and should be read as effectively requiring the user to open the file. Limiting factors: it is a local attack vector rather than a remotely-triggerable network service, code runs only with the opening user's privileges (S:U, no privilege escalation), and no automated or wormable exploitation path is indicated. Only the listed Office and SharePoint versions are affected. |
| Impact | The CVSS 3.1 base score is 8.4 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - high impact across confidentiality, integrity, and availability, low complexity, and no listed privileges. However, the vector contains an important tension: AV:L combined with UI:N conflicts with the real-world delivery model for an Office document-parsing bug, which almost always requires a victim to open a malicious file. Microsoft frequently scores such file-format vulnerabilities as UI:N even though user interaction is practically required; defenders should treat this as effectively requiring the target to open attacker-supplied content - verify UI:N against the MSRC advisory. There is no EPSS score, no CISA KEV listing, and no POC in the provided data, so this is a serious-but-not-actively-exploited issue: no public exploit identified at time of analysis. Priority is elevated by the enormous install base and code-execution potential, but tempered by the local vector and the practical need for user interaction. |
| Exploit ScenarioDerived | An attacker emails or hosts a specially crafted Office document (for example a Word or Excel file) and lures a user into opening it; the malformed structure triggers the out-of-bounds read in the parser, corrupting memory to execute code with that user's privileges. For SharePoint, a crafted document processed server-side could trigger the flaw in the service context. No public exploit is identified at time of analysis, so exploitation would require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps, and the macOS builds) stems from an out-of-bounds read in a file-parsing routine that lets a crafted document corrupt memory and run attacker-controlled code in the context of the current user. The same document-parsing components also affect SharePoint Enterprise Server 2016, SharePoint Server 2019, and the Subscription Edition. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55045 for your specific Office or SharePoint SKU; click-to-run/Microsoft 365 Apps builds update automatically while MSI-based Office 2016/2019/LTSC and SharePoint require deployment of the corresponding monthly cumulative update. Exact fixed version numbers are not provided in the input data, so confirm the correct build from the MSRC page before validating remediation. As compensating controls until patching completes, open untrusted documents in Protected View / Application Guard to sandbox the parser, block or quarantine Office file types (doc/docx/xls/xlsx/ppt/pptx and related) arriving from email and web at the gateway, and enable Attack Surface Reduction rules that restrict Office child-process creation - noting these controls can disrupt legitimate macro and embedded-content workflows. For SharePoint, restrict and monitor document upload/processing paths, accepting the operational overhead of tighter content controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 7 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-125 (out-of-bounds read): while parsing a malformed Office document, the code reads memory beyond the bounds of an allocated buffer. Although an OOB read most commonly yields information disclosure, Microsoft's advisory and the CVSS impact metrics indicate the condition is leverageable for code execution - typically because the mis-read data influences subsequent control-flow or pointer handling in the parser. The affected surface is the shared Office file-format parsing stack (Word/Excel/PowerPoint and related renderers) as reflected in the CPE set: microsoft_365_apps_for_enterprise, microsoft_office_2016, microsoft_office_2019, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, the Office 365/LTSC for Mac builds, plus SharePoint Enterprise Server 2016, SharePoint Server 2019, and Subscription Edition, which reuse the same document-processing libraries server-side.
Know when Microsoft Sharepoint Enterprise Server 2016 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
File-parsing flaw needs the victim to open a crafted document, so UI:R and AV:L; code runs as the current user (S:U) with full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
Executive ViewAI
Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps) and SharePoint editions are vulnerable to local code execution (CVSS 8.4) via maliciously crafted documents, with no public exploit identified at time of analysis. The widespread use of these productivity tools creates significant organizational risk: successful exploitation could compromise user workstations, enable data theft, and potentially affect connected systems and shared repositories.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Exploit-DB