Microsoft Office Word CVE-2026-55050

Exploitation requires a user to locally open a specially crafted Word document using one of the affected Microsoft Office or Word products on Windows or macOS. The CVSS UI:R metric confirms mandatory user interaction - the vulnerability cannot be triggered without a victim actively opening the file. The AV:L (Local) attack vector means this is not a network-exploitable flaw in the desktop client context; the attacker must deliver the file and rely on social engineering to get the victim to open it. The attacker requires no prior authentication or system privileges (PR:N) to craft and deliver the malicious document. For SharePoint Server deployments, the affected CPE scope suggests server-side document processing may also be a trigger path if documents are uploaded and parsed by SharePoint - but this is inferred from CPE scope and not explicitly confirmed in the description. What limits exploitation: mandatory user interaction eliminates drive-by or automated exploitation; the local attack vector prevents remote network-based triggering from the Word client; impact is restricted to information disclosure with no code execution or persistence capability; and SSVC confirms the attack is non-automatable.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 5.5 (Medium) and reflects the core risk profile accurately: the attack is local, requires no attacker privileges, demands user interaction via document opening, has no code execution capability, and yields only a Confidentiality:High impact - a memory disclosure primitive. EPSS at 0.39% (31st percentile) confirms low near-term exploitation probability, consistent with SSVC's assessment of exploitation status as 'none,' attack as non-automatable, and technical impact as 'partial.' No CISA KEV listing and no public POC have been identified. Despite the C:H rating, the local attack vector (AV:L) eliminates remote or network-based exploitation entirely, and the mandatory user interaction (UI:R) means mass exploitation is not feasible. The SharePoint Server CPE entries introduce a nuanced risk: if SharePoint performs server-side parsing of uploaded Word documents, the local vector characterization may understate risk in those deployments - however, this is inferred from the CPE scope, not confirmed in the description. Overall, this is a targeted, socially-engineered disclosure threat rather than a high-priority patch emergency.

An attacker crafts a malicious Word document containing a specially structured element - such as a malformed record in a legacy binary format or a corrupt Office Open XML stream - that causes the Word parser to read beyond its allocated buffer boundary. The attacker delivers the file via phishing email, a shared drive, or a SharePoint upload, and persuades the victim to open it locally. Upon opening, the out-of-bounds read exposes a region of the Word process's memory, potentially including previously loaded document content, cached credentials, or cryptographic material, which could be captured and exfiltrated through a macro-based or second-stage mechanism. No public proof-of-concept code has been identified at time of analysis.