EUVD-2026-44171
GHSA-2gjr-3wmx-7v5f
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attacker delivers a crafted file processed locally (AV:L) with no privileges (PR:N) but the victim must open it (UI:R); memory-corruption code execution gives full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office (Microsoft 365 Apps, Office 2016/2019, LTSC 2021/2024, Office for Mac, and SharePoint Server) arises from a heap-based buffer overflow (CWE-122) that an unauthorized attacker triggers when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R) with high confidentiality, integrity, and availability impact, meaning successful exploitation yields full code execution in the context of the current user. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of Office makes it a high-priority patch target.
Technical ContextAI
The flaw is a CWE-122 heap-based buffer overflow in Microsoft Office's file/document parsing code. Heap overflows occur when the application writes past the bounds of a heap-allocated buffer - typically because a length or size field in a crafted file is not validated before data is copied into an undersized allocation - corrupting adjacent heap metadata or object pointers that an attacker can groom to gain control of execution flow. The CPE data shows the affected surface spans the shared Office rendering/parsing components reused across the Windows Office suite (Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021 and 2024), the macOS builds (Office 365 for Mac, Office LTSC for Mac 2021 and 2024), and server-side document handling in SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, indicating the vulnerable code lives in a common Office file-processing library rather than a single application.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security updates for your specific Office and SharePoint channels as published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55125; the input confirms a fix is available from the vendor but does not list exact build numbers, so consult the MSRC update guide for the precise patched version per product. Prioritize Microsoft 365 Apps (which updates automatically but should be verified as current), then LTSC/perpetual builds and the SharePoint servers. Until updates are deployed, reduce exposure by opening untrusted documents in Protected View and blocking Office child-process creation and macro/embedded-content execution via Attack Surface Reduction rules; on mail gateways, filter or sandbox inbound Office attachments. The trade-off is that Protected View and ASR rules can interrupt legitimate document workflows and require user/whitelisting exceptions, so pilot them before broad enforcement.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today