Microsoft Office Word CVE-2026-55134

Exploitation requires the victim to open an attacker-crafted Word document on the local machine - the CVSS vector's UI:R makes user interaction a mandatory prerequisite, and AV:L means the malicious file must be delivered to and processed on the target host (e.g., via email attachment, download, or share). No attacker authentication is needed (PR:N) and no non-default configuration is stated as required; the limiting factors are the need for user interaction and the fact that code executes only in the opening user's security context, not automatically at elevated privilege. Note the affected-product list also includes SharePoint servers, where document parsing may occur server-side - if reachable that path could reduce the user-interaction requirement, but this is not confirmed in the provided data and should be verified against the MSRC advisory.

This is a credible but not top-tier emergency. The CVSS 3.1 base score is 7.8 (High) driven by high triple-impact, but the vector is bounded by AV:L (the crafted file must reach and be opened on the target machine) and UI:R (a user must open it), which meaningfully reduces automatability compared with a network-facing unauthenticated RCE. PR:N confirms no attacker authentication is needed once the file is delivered. No EPSS score, SSVC decision, or POC status was provided in the input, so the real-world exploitation probability cannot be quantified from available data; there is no public exploit identified and no CISA KEV listing, so there is no evidence of active exploitation. One point worth flagging for verification: the CPE list includes SharePoint server products, where document parsing can occur server-side without an interactive user - if the vulnerable code is reachable through a SharePoint document-processing flow, the practical attack vector and user-interaction assumptions could be more severe than the client-oriented AV:L/UI:R vector implies; confirm the SharePoint attack path with Microsoft's advisory. Overall: patch on the normal Patch-Tuesday cadence, prioritizing systems that routinely open untrusted documents.

An attacker emails or shares a booby-trapped Word document and uses social engineering to persuade a targeted user to open it; when Word parses the crafted content the stack buffer overflows and the attacker's code runs in the user's context, enabling data theft or a foothold for lateral movement. Because the CVSS vector is AV:L with AC:L and UI:R, exploitation is straightforward once the file is opened but hinges on that user action. No public exploit identified at time of analysis.