EUVD-2026-44181
GHSA-65x2-ccc4-wp24
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
File-parsing flaw needs the victim to open a crafted document, so UI:R and AV:L; code runs as the current user (S:U) with full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps, and the macOS builds) stems from an out-of-bounds read in a file-parsing routine that lets a crafted document corrupt memory and run attacker-controlled code in the context of the current user. The same document-parsing components also affect SharePoint Enterprise Server 2016, SharePoint Server 2019, and the Subscription Edition. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis.
Technical ContextAI
The root cause is CWE-125 (out-of-bounds read): while parsing a malformed Office document, the code reads memory beyond the bounds of an allocated buffer. Although an OOB read most commonly yields information disclosure, Microsoft's advisory and the CVSS impact metrics indicate the condition is leverageable for code execution - typically because the mis-read data influences subsequent control-flow or pointer handling in the parser. The affected surface is the shared Office file-format parsing stack (Word/Excel/PowerPoint and related renderers) as reflected in the CPE set: microsoft_365_apps_for_enterprise, microsoft_office_2016, microsoft_office_2019, microsoft_office_ltsc_2021, microsoft_office_ltsc_2024, the Office 365/LTSC for Mac builds, plus SharePoint Enterprise Server 2016, SharePoint Server 2019, and Subscription Edition, which reuse the same document-processing libraries server-side.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55045 for your specific Office or SharePoint SKU; click-to-run/Microsoft 365 Apps builds update automatically while MSI-based Office 2016/2019/LTSC and SharePoint require deployment of the corresponding monthly cumulative update. Exact fixed version numbers are not provided in the input data, so confirm the correct build from the MSRC page before validating remediation. As compensating controls until patching completes, open untrusted documents in Protected View / Application Guard to sandbox the parser, block or quarantine Office file types (doc/docx/xls/xlsx/ppt/pptx and related) arriving from email and web at the gateway, and enable Attack Surface Reduction rules that restrict Office child-process creation - noting these controls can disrupt legitimate macro and embedded-content workflows. For SharePoint, restrict and monitor document upload/processing paths, accepting the operational overhead of tighter content controls.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today