EUVD-2026-44183
GHSA-8vvr-gcrm-9jm8
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious file is parsed locally (AV:L) and needs the user to open it (UI:R) with no prior privileges (PR:N); memory-corruption RCE yields full C/I/A in the user's unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
AnalysisAI
Local arbitrary code execution in Microsoft Office (Microsoft 365 Apps for Enterprise, Office 2016/2019, Office LTSC 2021/2024, and their macOS equivalents) arises from a heap-based buffer overflow (CWE-122) that an attacker triggers by convincing a user to open a maliciously crafted Office document. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) shows the flaw requires user interaction but no prior privileges, yielding full high-impact compromise of confidentiality, integrity, and availability in the user's context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is not currently confirmed.
Technical ContextAI
The vulnerability is a heap-based buffer overflow (CWE-122), a memory-corruption class where a length-unchecked write into a heap-allocated buffer overruns adjacent allocations, corrupting heap metadata or neighboring objects and enabling attacker-controlled data to influence program flow. It resides in the file-parsing code paths of the Microsoft Office productivity suite - the CPE data confirms the affected code is shared across Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021 and 2024, and the macOS builds (Office 365 for Mac, Office LTSC for Mac 2021 and 2024), indicating the defect lies in a common document-processing component rather than a single application. Exploitation of such overflows in Office typically leverages malformed structures in a document format (e.g., embedded objects, fonts, or fields) parsed on open.
RemediationAI
Apply the vendor updates: Patch available per vendor advisory - install the Microsoft security updates for your specific channel/build as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55049 (Windows editions via Microsoft Update / Click-to-Run, and macOS editions via Microsoft AutoUpdate). Exact fixed version numbers are not included in the provided data, so consult the MSRC page for the build that applies to your deployment. Because exploitation requires a user to open a crafted file, compensating controls while patching include enforcing Protected View for files from the internet and email (trade-off: users may click 'Enable Editing', reducing effectiveness), blocking or quarantining risky Office attachments at the mail gateway, disabling legacy file-format support or macros where not needed, and applying Attack Surface Reduction rules on Windows to constrain Office child-process and content behavior (trade-off: may break some legitimate document workflows and add-ins). Restrict and monitor delivery of untrusted documents to high-value users until the update is deployed.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today