EUVD-2026-44196
GHSA-pwfq-7wq2-v4wr
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious document must be opened locally by the user (AV:L, UI:R) with no prior privileges (PR:N); memory-corruption RCE in the user's context yields full C/I/A impact, scope unchanged.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrary code in the context of the user who opens a maliciously crafted document. The flaw affects Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024 (including Mac editions), and the Word component shared with SharePoint Server 2016/2019/Subscription Edition. No public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation requires the victim to open the attacker's file (UI:R).
Technical ContextAI
The vulnerability is a CWE-121 stack-based buffer overflow in the file-parsing logic of the Microsoft Word rendering engine, which is bundled across the Office/Microsoft 365 suite and reused server-side by SharePoint for document handling (WebApps/Office Online rendering). A stack overflow occurs when the parser copies attacker-controlled data from a crafted Word document into a fixed-size stack buffer without adequate bounds checking, overwriting the return address or adjacent stack structures. Because the corrupted data lives on the call stack, successful control-flow hijack can lead to arbitrary code execution in the process context. The CPE set confirms the affected surface spans both desktop clients (Windows and macOS builds) and SharePoint server products that embed the same Office parsing code.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55055 across all affected Office/Microsoft 365 channels and the impacted SharePoint Server editions (2016, 2019, Subscription Edition); exact fixed build numbers are listed in that MSRC entry and should be matched to each deployed channel. Where immediate patching is not possible, reduce exposure by opening untrusted Word documents in Protected View / Application Guard (which sandboxes the parser and blunts the impact of the overflow), and enforce blocking of documents originating from the internet (Mark-of-the-Web) - the trade-off is user friction when legitimately editing externally-sourced files. For the SharePoint instances, restrict and monitor document-upload/rendering paths and prioritize the server patch, since server-side triggering would remove the user-interaction barrier. Do not rely on macro settings, as this is a parsing overflow independent of macros.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today