Microsoft Office Word CVE-2026-55142

User interaction is required: the victim must actively open a specially crafted Word document (UI:R from the CVSS vector). The attack vector is local (AV:L), meaning the malicious document must be present on the victim's file system or accessible local path at the time of opening - remote exploitation over a network without user file interaction is not supported by this vector. No operating system privileges are required to open the document (PR:N), but the attacker must successfully deliver the crafted file to the target, typically via social engineering. Exploitation is limited to the confidentiality dimension only - there is no integrity or availability impact (I:N, A:N). The scope is unchanged (S:U), meaning the vulnerability does not enable privilege escalation or cross-process exploitation beyond the Office application context. Non-automatable per SSVC, ruling out worm-like or spray-and-pray exploitation patterns.

The CVSS 3.1 base score of 5.5 (Medium) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a genuinely moderate risk profile: the attack is local and requires the victim to open a crafted document, which meaningfully constrains automatable exploitation. SSVC confirms this - Automatable: no, Exploitation: none, Technical Impact: partial - aligning well with the CVSS assessment. The EPSS score of 0.39% at the 31st percentile further corroborates low current threat actor interest. The C:H rating indicates that if triggered, the confidentiality impact is significant (full information disclosure), but the AV:L and UI:R prerequisites substantially limit who can reliably deliver and trigger this. There is no KEV listing, no POC, and no evidence of active exploitation. This is a patch-it-in-your-next-cycle vulnerability rather than an emergency response priority. One tension worth noting: PR:N in a local context means no OS-level privilege is required to open the document, but the attacker still depends on socially engineering document delivery, which introduces real-world friction the raw score does not capture.

An attacker crafts a malicious Word document containing a numeric value engineered to trigger the truncation error in Office's document parser, then delivers it to a target user via phishing email or a shared network location. When the user opens the document locally, the truncation error causes the parser to read beyond the intended memory boundary, disclosing sensitive in-process data to the attacker - potentially including document metadata, adjacent memory contents, or authentication material depending on memory layout at the time of execution. No public exploit identified at time of analysis, and SSVC rates this as non-automatable, meaning mass targeting is not a viable attack model.