EUVD-2026-44317
GHSA-jvm6-p83j-gp84
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
C:L added over vendor C:N because CWE-125 and the description explicitly cite information disclosure; AV:L/UI:R/PR:N retained as vendor-confirmed file-open trigger with no attacker privilege required.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
AnalysisAI
Memory parsing across Microsoft Office and SharePoint Server products is susceptible to a CWE-125 out-of-bounds read that, when triggered by opening a specially crafted Office document, produces local information disclosure or application availability loss. The affected surface is broad - spanning Microsoft 365 Apps for Enterprise, Office 2016 through LTSC 2024 on both Windows and macOS, and SharePoint Enterprise Server 2016, 2019, and Subscription Edition - but real-world exploitation pressure is low: EPSS sits at 0.36% (28th percentile), CISA SSVC rates exploitation as none and the attack as non-automatable, and no public exploit has been identified at time of analysis. Vendor-released patches are available for all affected product lines.
Technical ContextAI
CVE-2026-55121 is rooted in CWE-125 (Out-of-Bounds Read), a memory-safety class where a parsing routine reads beyond the allocated buffer boundary when processing attacker-controlled input - in this case, a crafted Office document or SharePoint content. Out-of-bounds reads have two canonical consequences: the over-read may expose adjacent heap or stack memory contents (information disclosure), or it may dereference invalid memory and crash the application (availability loss). The CPE surface confirms the vulnerable parsing code is shared across Microsoft's entire Office document-processing library chain: Windows builds spanning Office 2016, 2019, LTSC 2021, LTSC 2024, and 365 Apps for Enterprise; macOS builds for Office 365 for Mac and Office LTSC for Mac 2021 and 2024; and server-side document-processing components in SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. The co-location of Windows client, macOS client, and SharePoint server in a single CVE strongly implies the flaw resides in a shared Office Open XML or binary document parsing library rather than platform-specific code.
RemediationAI
Apply vendor-released patches via Microsoft Update or the Office Deployment Tool as the primary remediation. For Microsoft Office 2016 on Windows, update to build 16.0.5561.1000 or later. For SharePoint Enterprise Server 2016, update to build 16.0.5561.1001 or later. For SharePoint Server 2019, update to build 16.0.10417.20175 or later. For SharePoint Server Subscription Edition, update to build 16.0.19725.20434 or later. For Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024 on Windows, apply the latest update via https://aka.ms/OfficeSecurityReleases. For all macOS Office variants (Office 365 for Mac, Office LTSC for Mac 2021, Office LTSC for Mac 2024), update to build 16.111.26071215 or later. Full patch details are available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55121. If immediate patching is not feasible, enforce Protected View for documents originating from untrusted sources and external locations via Group Policy (Office Administrative Templates) - this adds a read-only sandbox layer that significantly raises the bar for exploitation, though it does not eliminate risk if users manually enable editing. Blocking macro-enabled document formats at the mail gateway is an additional compensating control but does not specifically address this parsing flaw, which may affect non-macro formats.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today