What is the CVSS score of CVE-2026-55127?

CVE-2026-55127 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Word are affected by CVE-2026-55127?

Microsoft Word and Microsoft 365 face a code-execution vulnerability (CVE-2026-55127) triggered by opening malicious documents, creating organization-wide risk of account compromise and data theft.. A patch is available.

How to fix or mitigate CVE-2026-55127?

Within 24 hours, create an inventory of all Microsoft Office installations across your organization including Office 2019, Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, macOS Office editions, and on-premises SharePoint Server. Within 7 days, apply the vendor-released patch to all identified systems using your standard patch management and change-control processes, prioritizing business-critical workstations and systems with privileged access. Within 30 days, confirm patch deployment across your entire user base, remind staff about document-safety practices, and audit your email and collaboration tools for security controls that can detect or block suspicious document activity.

Microsoft Word CVE-2026-55127

EUVD-2026-44189 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-14 microsoft

GHSA-3hh6-685p-ww7j

Buffer Overflow Heap Overflow Microsoft Microsoft Sharepoint Enterprise Server 2016 Microsoft Sharepoint Server 2019 Microsoft Sharepoint Server Subscription Edition Microsoft 365 Apps For Enterprise Microsoft Office Ltsc 2024 Microsoft Office 2019 Microsoft Office Ltsc 2021 Microsoft Office Ltsc For Mac 2021 Microsoft Office Ltsc For Mac 2024 Microsoft Word 2016 Microsoft Office 365 For Mac

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

vuln.today AI

7.8 HIGH

Malicious document must be opened by a user (AV:L, UI:R) with no prior auth (PR:N); reliable overflow yields full code execution in user context, so C/I/A:H and S:U.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:19 vuln.today

CVE Published

Jul 14, 2026 - 17:08 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized attacker run arbitrary code when a victim opens a maliciously crafted Word document that triggers a heap-based buffer overflow. All impacted SKUs - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, the macOS Office builds, and SharePoint Server (which renders Office documents server-side) - are affected, and Microsoft has released a patch. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

The root cause is CWE-122, a heap-based buffer overflow, occurring in the file-parsing code that Microsoft Word uses to process document data. When Word deserializes a crafted document, an undersized heap allocation is overrun, corrupting adjacent heap metadata or object pointers that an attacker can groom to hijack control flow and achieve arbitrary code execution in the context of the current user. The CPE data shows the same vulnerable Office rendering component is shared across desktop Office (365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024), the Mac editions (Office 365 for Mac, Office LTSC for Mac 2021/2024), and server-side SharePoint (Enterprise Server 2016, Server 2019, Subscription Edition), meaning the exposure extends beyond the desktop client to servers that open or preview Office files.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-55127 as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55127, selecting the fixed build that matches each installed SKU (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, the Mac editions, and SharePoint Server 2016/2019/Subscription Edition); the input does not include exact fixed build numbers, so retrieve them from the MSRC update guide before deployment. Prioritize SharePoint servers, which process untrusted documents server-side. Until patches are deployed, compensating controls include enabling and enforcing Protected View / Office 'Block opening files from the Internet' policies so documents from email and web download open in a sandbox (trade-off: users must click 'Enable Editing', causing minor friction), blocking or quarantining inbound Office attachments at the mail gateway, and using Attack Surface Reduction rules to constrain Office child-process creation (trade-off: may break legitimate macros or add-ins). Advise users not to open unexpected Word documents.