Microsoft Office CVE-2026-55125

Exploitation requires user interaction (UI:R): the victim must open an attacker-supplied, specially crafted Office document that reaches the vulnerable heap parsing code - there is no network service being attacked directly (AV:L), and no prior authentication or privileges on the target are needed (PR:N). Limiting factors that reduce realistic risk: the attack fails if the user never opens the malicious file, if the document is opened in Protected View / sandboxed rather than fully processed, or if ASR/attachment-filtering controls block delivery or the post-exploitation payload. Code executes only at the privilege level of the user who opens the file, so a low-privilege user session constrains blast radius absent a separate privilege-escalation step.

The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8) describes a low-complexity, unauthenticated but user-interaction-dependent local code-execution flaw - the classic 'open a malicious document' pattern where AV:L reflects that the attacker delivers a file rather than reaching the target over the network. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation-probability signals are absent; this yields no public exploit identified at time of analysis and no evidence of active exploitation. The real-world priority is driven less by novelty than by prevalence: Office is deployed almost everywhere, phishing-delivered documents are a proven initial-access vector, and Microsoft-class heap overflows are historically weaponizable, so this should be treated as a genuine patch priority despite the lack of a public exploit. Note the tension worth flagging: the vector is AV:L (local) yet the practical delivery is remote-via-email/download, so 'local' here means local file processing, not that the attacker needs prior host access - verify delivery assumptions when scoring internally.

An attacker emails a victim a specially crafted Office document (or hosts it for download) and, through social engineering, convinces the user to open it; when Office parses the malformed structure the heap-based buffer overflow is triggered and attacker-controlled code runs in the context of that user. Because AC is low and no authentication is required beyond the victim opening the file, the only barrier is the user-interaction requirement (UI:R). No public POC was provided in the input.