What is the CVSS score of CVE-2026-55128?

CVE-2026-55128 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Microsoft Word are affected by CVE-2026-55128?

Microsoft Office Word contains a vulnerability (CVE-2026-55128, CVSS 7.8) that could allow attackers to compromise systems through malicious documents, affecting Microsoft 365 Apps, Office 2019, and…. A patch is available.

How to fix or mitigate CVE-2026-55128?

Within 24 hours, inventory all deployed Microsoft Office versions (365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024) across Windows and macOS endpoints to understand the scope of affected systems. Within 7 days, begin deploying the vendor-released security patch to all identified installations through your standard software distribution channel; prioritize administrative users and systems that regularly handle sensitive documents. Within 30 days, ensure patch deployment is complete across the entire organization, verify installation through endpoint monitoring and update status reports, and confirm that no security deferral or rollback of the patch has occurred during this period.

Microsoft Word CVE-2026-55128

EUVD-2026-44214 HIGH

Use After Free (CWE-416)

2026-07-14 microsoft

GHSA-6f4x-v88v-3f2g

Denial Of Service Use After Free Memory Corruption Microsoft Microsoft Sharepoint Enterprise Server 2016 Microsoft Sharepoint Server 2019 Microsoft Sharepoint Server Subscription Edition Microsoft 365 Apps For Enterprise Microsoft Office Ltsc 2024 Microsoft Office 2019 Microsoft Office Ltsc 2021 Microsoft Office Ltsc For Mac 2021 Microsoft Office Ltsc For Mac 2024 Microsoft Word 2016 Microsoft Office 365 For Mac

High

Disputed · 7.8 Vendor: microsoft

Temporal: 6.8

Severity by source

Sources disagree (Medium–Critical)

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today AI

7.8 HIGH

Local file-open vector so AV:L with mandatory UI:R; no privileges needed (PR:N) and low complexity, with full code execution in user context giving C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:18 vuln.today

CVE Published

Jul 14, 2026 - 17:09 nvd

HIGH 7.8

DescriptionCVE.org

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office Word (CWE-416 use-after-free) allows an unauthorized attacker to run arbitrary code in the context of the current user when a victim opens a maliciously crafted document. The flaw affects a broad Office footprint including Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024 (Windows and Mac), and related SharePoint Server products that process Word documents. Microsoft has released a patch; no public exploit has been identified at time of analysis, and neither KEV nor EPSS/POC signals were provided in the input.

Technical ContextAI

The root cause is a use-after-free (CWE-416): the Word document parser frees a memory object but retains a dangling reference that is later reused, letting an attacker who controls the freed-then-reallocated memory corrupt program state and hijack control flow. The affected components are Microsoft's Office rich-text/Word document rendering engine as identified by the CPE strings (microsoft_365_apps_for_enterprise, microsoft_office_2019, microsoft_office_365_for_mac, microsoft_office_ltsc_2021/2024, microsoft_office_ltsc_for_mac_2021/2024) plus the server-side document handling in microsoft_sharepoint_enterprise_server_2016, microsoft_sharepoint_server_2019 and the subscription edition, which parse the same file formats. Memory-corruption bugs of this class in Office document parsers are a recurring vector because they process complex, untrusted file structures with legacy code paths.

RemediationAI

Apply the Microsoft security update for CVE-2026-55128 as the primary fix - Patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55128; for Microsoft 365 Apps and Click-to-Run channels ensure automatic updates are current, and for Office 2019/LTSC and SharePoint deploy the corresponding monthly security update. The exact fixed build numbers are not provided in the input and must be taken from the MSRC advisory. Until patching completes, reduce exposure by enabling Protected View and blocking macros/active content for documents from the internet, and configuring Office to open files from untrusted locations in a sandboxed/Protected View mode; note this can disrupt legitimate documents that require editing. Enforce Attack Surface Reduction rules that block Office child-process creation and restrict opening of documents received via email or web, accepting some user-workflow friction as the trade-off. For SharePoint servers, restrict and monitor document upload/processing paths and apply the server-side update promptly.