What is the CVSS score of CVE-2026-55132?

CVE-2026-55132 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Word are affected by CVE-2026-55132?

A critical vulnerability in Microsoft Word and Office applications allows attackers to execute arbitrary code when users open specially crafted documents, potentially compromising systems…. A patch is available.

How to fix or mitigate CVE-2026-55132?

Within 24 hours: Identify all systems running affected Office versions (Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps, Office for Mac) and communicate patch availability to stakeholders with emphasis on restricting opening documents from untrusted sources until patched. Within 7 days: Deploy the Microsoft patch across all affected Office installations using your standard patch management process and configuration management tools; prioritize endpoints with high document-sharing exposure (finance, legal, executive functions). Within 30 days: Complete verification that all Office instances have been updated, monitor for any exploitation attempts or anomalous document-opening activity, and conduct a post-patch audit to confirm full remediation.

Microsoft Word CVE-2026-55132

EUVD-2026-44201 HIGH

Double Free (CWE-415)

2026-07-14 microsoft

GHSA-wccm-7wfc-h3w3

Authentication Bypass Microsoft Microsoft Sharepoint Enterprise Server 2016 Microsoft Sharepoint Server 2019 Microsoft Sharepoint Server Subscription Edition Microsoft 365 Apps For Enterprise Microsoft Office Ltsc 2024 Microsoft Office 2019 Microsoft Office Ltsc 2021 Microsoft Office Ltsc For Mac 2021 Microsoft Office Ltsc For Mac 2024 Microsoft Word 2016 Microsoft Office 365 For Mac

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

vuln.today AI

7.8 HIGH

File-open client RCE: AV:L and UI:R because the victim must open a crafted document, PR:N as no auth is needed, and full C/I/A High from arbitrary code execution.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:16 vuln.today

CVE Published

Jul 14, 2026 - 17:08 nvd

HIGH 7.8

DescriptionCVE.org

Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for Mac) stems from a double free of heap memory (CWE-415) that lets an unauthorized attacker run arbitrary code when a victim opens a malicious document. The flaw was reported by Microsoft, carries CVSS 7.8, and a vendor patch is available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because exploitation requires the target to open a crafted file (UI:R), it is a user-interaction-gated client-side RCE rather than a remotely-triggerable service bug.

Technical ContextAI

The root cause is CWE-415 (Double Free): the same heap allocation is released twice during Word's parsing/handling of a document, corrupting heap metadata or freelist state. An attacker who controls the freed-then-reallocated memory can pivot heap corruption into controlled writes and ultimately arbitrary code execution in the context of the Office process. The CPE set shows the parsing code is shared broadly across the Office family - Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021 and 2024 (Windows and Mac), Office 365 for Mac, and the SharePoint Server 2016/2019/Subscription Edition products that embed Office document-handling components - indicating a common file-processing module rather than a single edition-specific bug.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55132 for each affected SKU (Microsoft 365 Apps via Click-to-Run channel updates, Office LTSC 2021/2024 and Office 2019 via the corresponding MSI/Click-to-Run packages, Office for Mac via AutoUpdate, and SharePoint 2016/2019/Subscription Edition server updates); the advisory contains the exact fixed build numbers, which are not reproduced in the input data. Until patching completes, reduce exposure by opening untrusted documents in Protected View / Application Guard (limits the exploit to a sandboxed process, with a usability trade-off that macros and editing are blocked), blocking or quarantining Office attachments from external senders at the mail gateway (may delay legitimate business documents), and enabling attack-surface-reduction rules for Office child-process creation on Windows endpoints. These are compensating controls only; the vendor patch is the definitive fix.