Microsoft Office CVE-2026-56195

User interaction is required - the target must open or preview a maliciously crafted Office document, as indicated by UI:R in the CVSS vector. The attack vector is local (AV:L), meaning the malicious file must be accessible to the user's local system, typically via a delivered attachment, downloaded file, or shared network path. No system-level authentication or elevated privileges are required from the attacker (PR:N), but social engineering or another delivery mechanism is necessary to place the file in reach of the target user. Exploitation is limited to confidentiality impact only (I:N, A:N) and is contained within the Office process scope (S:U). SSVC confirms the attack is not automatable, ruling out worm-style propagation. No specific non-default configuration of Office is required - any vulnerable installed version is affected when processing a crafted file.

Multiple signals converge on a moderate real-world priority. The CVSS base score of 5.5 reflects the local attack vector (AV:L) and required user interaction (UI:R), which substantially limit opportunistic exploitation compared to a network-reachable flaw. PR:N confirms no system authentication is required, but the local vector means an attacker must first deliver a malicious file and rely on user action - a non-trivial barrier consistent with SSVC's Automatable: no classification. SSVC also rates exploitation as none and technical impact as partial, reinforcing that this is not a zero-friction attack path. EPSS data was not provided, so quantitative exploitation probability cannot be assessed. The flaw is not in CISA KEV, and no public exploit has been identified at time of analysis. The primary risk driver is breadth of exposure: virtually every enterprise Windows or macOS environment runs a vulnerable Office version, so even a locally-exploited information disclosure at moderate probability represents a realistic phishing-to-document-open attack chain against high-value targets. The absence of integrity and availability impact (I:N, A:N) means this cannot be used standalone for persistence or disruption - it is most dangerous as a reconnaissance or credential-harvesting step chained with other techniques.

An attacker crafts a malicious Office document containing a file-format structure with a deliberately malformed length or offset field designed to trigger an out-of-bounds read in the Office parser. The attacker delivers this file via phishing email or a compromised file share, and when a target user opens it in a vulnerable version of Office, the parser reads memory beyond the intended buffer boundary, potentially leaking process memory contents - including document fragments, session tokens, or cached credentials - which the attacker retrieves through an embedded exfiltration mechanism or by observing application behavior. No public exploit code has been identified at time of analysis, but the attack requires no special technical knowledge beyond crafting or adapting the malicious file.