Microsoft Office CVE-2026-55047

Exploitation requires that the victim open a specially crafted Office document using an affected version of Microsoft Office or a SharePoint-integrated client application. The CVSS UI:R metric confirms user interaction is mandatory - the file cannot be exploited passively or remotely without the victim actively opening it. The CVSS AV:L metric confirms the attack is local: the malicious document must be parsed by a locally running Office process, ruling out purely network-based exploitation absent a social engineering or file-delivery step. The CVSS PR:N metric indicates the attacker does not need privileges on the victim system - only the ability to deliver the file. Exploitation is limited to confidentiality impact (C:H); no integrity or availability loss occurs. Exploitation is not automatable per CISA SSVC, meaning mass scanning or worm-style propagation is not applicable. SharePoint Server deployments expand the delivery surface if users open documents directly through SharePoint, but the parsing vulnerability itself still executes locally within the Office client application.

The CVSS 3.1 base score of 5.5 (Medium) reflects an AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N profile: local vector, low complexity, no required privileges, but mandatory user interaction, with no integrity or availability impact. The C:H rating means successfully reading out-of-bounds memory could expose sensitive in-process data, though the actual value of that data depends heavily on runtime state. EPSS at 0.50% (39th percentile) aligns with CISA SSVC's assessment of zero confirmed exploitation and non-automatable attack path - meaning mass opportunistic exploitation is not currently occurring. The flaw is not listed in CISA KEV, and no public exploit or POC has been identified. The combination of a local attack vector and required user interaction substantially limits real-world risk compared to network-exploitable, interaction-free flaws of similar CVSS score. The broad product surface (11 CPE entries across Windows and Mac Office and SharePoint) is a concern for patch coverage but does not elevate the immediacy of the threat. This is a genuine medium-priority patch cycle item - not a drop-everything emergency - consistent with all available signals.

An attacker crafts a malicious Office document designed to trigger the out-of-bounds read in the parsing engine and delivers it to a target via phishing email or shared drive. When the victim opens the file in an affected version of Microsoft Office or a SharePoint-integrated Office application, the vulnerable parser reads past the allocated buffer boundary, potentially leaking heap or stack memory contents to the attacker - for example, through embedded macros or document-level callbacks that can capture and exfiltrate the disclosed data. No public exploit or POC is currently known, meaning this scenario requires attacker-developed tooling.