Microsoft Word CVE-2026-55128

Exploitation requires the victim to open or preview an attacker-crafted Word document - the CVSS UI:R flag confirms mandatory user interaction, which is the key limiting factor. The attack vector is Local (AV:L): code executes only when the malicious file is processed on the target host, typically after delivery via email, web download, or file share, not via direct network exploitation of Word. No authentication or elevated privileges are needed (PR:N), and complexity is low (AC:L), so any user who opens the document is at risk across default configurations of the affected Office/SharePoint builds. On SharePoint the condition is server-side processing of an uploaded malicious document. Mitigations such as Protected View or blocking documents from untrusted sources meaningfully raise the bar because they interrupt the open-and-parse step.

The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): local attack vector, low complexity, no privileges, but user interaction required, yielding full high impact to confidentiality, integrity, and availability within the user's context. This is the classic 'open a malicious document' profile - technically 'local' because the attacker cannot reach the parser over the network directly, yet in practice it is delivered remotely via phishing, so the UI:R requirement (the victim must open the file) is the primary limiting factor rather than genuine local access. No EPSS score, KEV listing, or POC indicator was supplied, so this should currently be treated as a real-but-not-emergency priority: high severity and wide product exposure, but no confirmed active exploitation. The absence of exploitation telemetry in the input means risk is driven by prevalence and phishing likelihood, not by observed campaigns; re-triage upward if it later appears in CISA KEV.

An attacker emails or hosts a specially crafted Word document and lures a victim into opening it (e.g., an invoice or resume lure). On open, Word's parser triggers the use-after-free, the attacker-controlled memory reuse hijacks execution, and arbitrary code runs with the victim's privileges - enabling malware installation or credential theft. No public POC is identified in the provided data.