EUVD-2026-44189
GHSA-3hh6-685p-ww7j
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious document must be opened by a user (AV:L, UI:R) with no prior auth (PR:N); reliable overflow yields full code execution in user context, so C/I/A:H and S:U.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Word (and the wider Microsoft Office / Microsoft 365 Apps family) lets an unauthorized attacker run arbitrary code when a victim opens a maliciously crafted Word document that triggers a heap-based buffer overflow. All impacted SKUs - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024, the macOS Office builds, and SharePoint Server (which renders Office documents server-side) - are affected, and Microsoft has released a patch. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Technical ContextAI
The root cause is CWE-122, a heap-based buffer overflow, occurring in the file-parsing code that Microsoft Word uses to process document data. When Word deserializes a crafted document, an undersized heap allocation is overrun, corrupting adjacent heap metadata or object pointers that an attacker can groom to hijack control flow and achieve arbitrary code execution in the context of the current user. The CPE data shows the same vulnerable Office rendering component is shared across desktop Office (365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024), the Mac editions (Office 365 for Mac, Office LTSC for Mac 2021/2024), and server-side SharePoint (Enterprise Server 2016, Server 2019, Subscription Edition), meaning the exposure extends beyond the desktop client to servers that open or preview Office files.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-55127 as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55127, selecting the fixed build that matches each installed SKU (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, the Mac editions, and SharePoint Server 2016/2019/Subscription Edition); the input does not include exact fixed build numbers, so retrieve them from the MSRC update guide before deployment. Prioritize SharePoint servers, which process untrusted documents server-side. Until patches are deployed, compensating controls include enabling and enforcing Protected View / Office 'Block opening files from the Internet' policies so documents from email and web download open in a sandbox (trade-off: users must click 'Enable Editing', causing minor friction), blocking or quarantining inbound Office attachments at the mail gateway, and using Attack Surface Reduction rules to constrain Office child-process creation (trade-off: may break legitimate macros or add-ins). Advise users not to open unexpected Word documents.
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Arbitrary code execution in Microsoft PowerPoint (and the broader Microsoft Office/365 suite on Windows and macOS) arise
Local code execution in Microsoft Office PowerPoint (including Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, a
Local code execution in Microsoft Office PowerPoint (CWE-122 heap-based buffer overflow) lets an unauthorized attacker r
Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-
Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary
Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrar
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, an
Numeric truncation error (CWE-197) in Microsoft Office Word triggers local information disclosure when a user opens a ma
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today