Microsoft Word CVE-2026-55127

Exploitation requires a victim to open an attacker-crafted Word/Office document (UI:R in the CVSS vector), so it is not remotely triggerable without user action; no prior authentication or privileges on the target are needed (PR:N). The attack runs in the local context of whoever opens the file (AV:L, S:U), so the attacker gains only that user's privileges, not SYSTEM. What limits exploitation: the need for social engineering to get the file opened, and Office defenses such as Protected View - a document opened in Protected View will not trigger the vulnerable editing path unless the user clicks 'Enable Editing'. On SharePoint Server, the condition is that the server parses/renders an attacker-supplied Office document, which broadens the trigger surface beyond interactive desktop use.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - the 'local' attack vector combined with 'user interaction required' is the classic malicious-document profile: the attacker cannot reach the target over the network directly but instead relies on a user opening a booby-trapped file. PR:N means no prior authentication is needed, and low complexity (AC:L) means the overflow triggers reliably once the file is opened, yielding full confidentiality, integrity, and availability impact within the user's security context (S:U, no privilege boundary crossed). No EPSS score, SSVC decision, or KEV entry was provided, so exploitation probability cannot be quantified from the input; the absence of a KEV listing and of any POC signal suggests this is not currently mass-exploited. The practical priority is driven by the enormous install base rather than by confirmed active exploitation - a weaponized document sent by phishing is the realistic threat, so treat it as a standard-priority Patch Tuesday-class fix and deploy promptly, especially on SharePoint servers that process untrusted documents.

An attacker crafts a malicious Word document that triggers the heap overflow and delivers it via phishing email, a shared link, or a web download. When the victim opens the file, the overflow corrupts the heap and executes attacker-supplied code with the user's privileges, giving the attacker a foothold for follow-on actions such as credential theft or lateral movement. No public exploit is identified at time of analysis, but the pattern is well understood and reproducible once a working trigger is developed.