Microsoft Office Word CVE-2026-55124

Exploitation requires the victim to actively open a specially crafted Word document, making user interaction an absolute prerequisite (UI:R in CVSS). The attack vector is local (AV:L), meaning the malicious file must be opened and processed on the victim's own machine - remote delivery via email or download is the likely delivery mechanism, but the vulnerability triggers at the point of local file open. No privileges are required of the attacker (PR:N), but the victim must have a standard user session to open the file. The vulnerability is limited strictly to confidentiality impact (C:H); no code execution, data modification, or availability disruption is possible through this flaw alone. The SharePoint CPE entries raise an open question: if SharePoint performs server-side document rendering or preview generation on uploaded files, the UI:R constraint may not apply on the server, potentially reducing the barrier to exploitation in SharePoint deployments. This has not been confirmed by Microsoft's advisory language and should be verified independently. Protected View (MOTW enforcement) effectively blocks this vector for documents downloaded from the internet if left enabled.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) yields a Medium score of 5.5, anchored by the local-only attack vector and required user interaction, which significantly constrain exploitation reach. The high confidentiality impact (C:H) is the main driver of concern, as successful exploitation could expose sensitive in-memory data. EPSS at 0.39% (31st percentile) is low, reflecting minimal observed automated exploitation interest. CISA SSVC further confirms exploitation status as 'none,' marks the vulnerability as non-automatable, and rates technical impact as 'partial.' This is not currently in CISA KEV and no POC is confirmed. Taken together, these signals indicate a real but low-priority risk in isolation - this is not a high-CVSS-but-low-real-risk scenario so much as a genuinely medium-severity flaw with a narrow exploitation path. One area warranting independent verification: SharePoint's inclusion in the affected CPE list raises the possibility that server-side document rendering could alter the UI:R prerequisite - if SharePoint auto-processes uploaded documents, the user-interaction barrier on the server may not apply.

An attacker crafts a malicious Word document containing specially structured content designed to trigger the improper type validation flaw during parsing. The document is delivered to a target via email, a file share, or a web download, and when the victim opens it on their local system, the Office Word parser mishandles the malformed input type and reads memory contents beyond the intended buffer, disclosing potentially sensitive data. No confirmed public exploit code exists at time of analysis, and the non-automatable SSVC classification indicates mass delivery is not a practical threat vector.