Microsoft Office CVE-2026-55140

Exploitation requires the victim to open a specially crafted Microsoft Office document in a vulnerable Office edition (PR:N, UI:R) - the document itself is the delivery mechanism, so the exploit succeeds against default Office configurations with no special feature toggle needed, but it will NOT fire without that user action. Limiting factors that reduce realistic risk: mandatory user interaction (opening/previewing the malicious file), execution confined to the current user's privilege level (S:U, no privilege escalation implied), and the local file-open vector meaning the file must reach and be actioned by the target. Protected View, Mark-of-the-Web blocking, or mail-gateway filtering of the delivery file will each interrupt the required open step.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a file-borne local vector: no privileges are needed (PR:N) but the victim must open a malicious document (UI:R), and successful exploitation yields full high impact on the host in the user's context. No EPSS score was supplied and no SSVC decision data is present, so probabilistic exploitation signals cannot be weighed here. The vulnerability is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation or public exploit code at this time. This is a real but interaction-gated risk: the requirement for user interaction and the local vector lower the automatable/wormable potential compared to a network-facing RCE, yet Office document overflows are a historically favored phishing payload, so the practical priority is elevated for organizations with broad Office deployment. Note the AV:L classification reflects that the malicious file is opened locally even though it is typically delivered remotely - this is standard Microsoft scoring for document-open bugs and should not be read as requiring pre-existing local access.

An attacker emails a booby-trapped Office document (or hosts it on a share or website) to a target and, through social engineering, persuades the user to open it. When Office parses the crafted file, the heap-based buffer overflow is triggered and the attacker's shellcode runs with the privileges of the logged-in user, giving foothold for data theft or further compromise. No public POC is identified at this time, and the AC:L/UI:R metrics indicate the primary barrier is convincing the victim to open the file rather than technical exploitation difficulty.