Microsoft Office CVE-2026-55129

Exploitation requires the victim to open an attacker-supplied malicious Office document - the CVSS vector's UI:R confirms user interaction is mandatory, which is the primary limiting factor. The attack is local vector (AV:L) and needs no pre-existing privileges or authentication (PR:N), so any user tricked into opening a crafted file on an unpatched Office install (Microsoft 365 Apps, Office 2016/2019, LTSC 2021/2024, or the Mac equivalents) is exploitable in default configurations. Realistic risk is bounded by the need for social engineering to deliver and open the file, and by mitigations such as Protected View / Mark-of-the-Web sandboxing that intercept internet-sourced documents before full parsing.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High) describes a low-complexity, no-privilege attack that nonetheless requires user interaction and is scored local vector because exploitation happens through file handling on the target machine rather than over the network. This is the classic phishing/malicious-document risk profile: real and routinely weaponized as a category, but gated by the victim opening a file. No EPSS score, SSVC decision, or POC signal is present in the input, and the CVE is not in CISA KEV, so there is no evidence of active exploitation or automatable mass-exploitation at this time. Given Office's enormous install base, this warrants prompt patching, but the required user interaction and absence of known exploitation place it below drive-by/network-wormable criticals in urgency.

An attacker emails a target a specially crafted Office document (or hosts it for download) and uses social engineering to get the victim to open it. When opened, the malformed file triggers the heap overflow in Office's parser, executing attacker code with the victim's privileges - enabling malware installation or credential theft. No public exploit is identified at time of analysis.