Microsoft Office CVE-2026-55057

Exploitation requires that a victim with a local session on the target system open a specially crafted Office document, satisfying the mandatory user interaction (UI:R) in the CVSS vector. The attack vector is local (AV:L), meaning the malicious file must be accessible on the victim's local system and the victim must actively open it - remote unauthenticated network exploitation is not possible. No elevated privileges are required of the attacker (PR:N), but the attacker must be able to place or deliver the malicious document to the victim's accessible file system or induce the victim to open it. Impact is limited strictly to confidentiality (C:H, I:N, A:N); there is no code execution, persistence, or integrity impact implied. Exploitation is further constrained by the non-automatable nature of the attack (SSVC: Automatable: no), requiring individual victim interaction per exploitation attempt.

The CVSS 3.1 base score of 5.5 (Medium) reflects a local attack vector (AV:L), low attack complexity (AC:L), no required privileges (PR:N), mandatory user interaction (UI:R), and a confined scope (S:U) with High confidentiality impact but no integrity or availability impact. The local attack vector significantly constrains real-world exploitability - an attacker cannot remotely trigger this without the victim explicitly interacting with a malicious file on their local system. EPSS at 0.39% (31st percentile) corroborates the low exploitation likelihood, and CISA SSVC reinforces this with Exploitation: none and Automatable: no. The SSVC Technical Impact of partial aligns with information disclosure only, with no code execution or system compromise implied. This is not a KEV-listed vulnerability and no public exploit code has been identified. Despite the wide product deployment footprint, the combination of local vector, required user interaction, and absence of active exploitation signals makes this a medium-priority patch rather than an emergency response item. There is no conflict between CVSS and real-world signals - both consistently indicate moderate risk.

An attacker crafts a specially malformed Office document designed to trigger an integer overflow in a size or offset calculation during document parsing. The attacker delivers this file to a target user via email or shared storage; when the victim opens the document in an unpatched version of Microsoft Office, the overflow causes the application to read out-of-bounds memory and potentially expose sensitive data from the process memory space to the attacker. No public proof-of-concept code has been identified at time of analysis.