Microsoft Office CVE-2026-55049

Exploitation requires the victim to open an attacker-supplied malicious Office document on a host running an affected Office build (AV:L with UI:R) - the file must be processed locally by the vulnerable parser. No prior authentication or privileges on the target are needed (PR:N), and complexity is low (AC:L), so no special timing or configuration is required beyond delivering the file and inducing the open. Limiting factors: mandatory user interaction (the document must be opened, and Microsoft's Protected View sandbox for internet/email-sourced files can block the initial parse until a user chooses 'Enable Editing'); code executes only in the opening user's context (scope unchanged, S:U), so it does not by itself grant elevation; and the target must be one of the listed Office/365/LTSC editions on Windows or macOS.

This is a credible but interaction-gated priority. The CVSS 3.1 base score of 7.8 (High) reflects local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:R) with full C/I/A impact in an unchanged scope. In practice AV:L for Office means the malicious file is processed on the target host, and UI:R means a user must open the crafted document - this materially lowers real-world risk versus a zero-click network flaw. No EPSS score was supplied, so exploitation probability cannot be quantified from this data. It is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation; however, Office document-parsing overflows are historically attractive for phishing-driven campaigns, so the ceiling risk is meaningful. Net: patch on a normal-to-elevated cadence, prioritizing high-phishing-exposure users, rather than treating it as an emergency zero-day.

An attacker emails a target a specially crafted Office document (or hosts it for download) that contains a malformed structure designed to overflow a heap buffer during parsing. When the victim opens the file - and, where applicable, exits Protected View - the overflow corrupts heap memory and executes attacker-supplied code in the context of the logged-in user, enabling malware installation or data theft. No public POC is referenced in the provided data, so a working exploit would need to be developed.