What is the CVSS score of EUVD-2026-44215?

EUVD-2026-44215 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Microsoft Sharepoint Enterprise Server 2016 are affected by EUVD-2026-44215?

CVE-2026-55130 is a critical vulnerability in Microsoft Word (Office 2016, 2019, Microsoft 365 Apps, and LTSC 2021/2024) that enables attackers to compromise entire workstations through social…. A patch is available.

How to fix or mitigate EUVD-2026-44215?

Within 24 hours, inventory all systems running Microsoft Office 2016, 2019, Microsoft 365 Apps, or Office LTSC 2021/2024 and assess exposure based on document-sharing workflows and user risk profiles. Within 7 days, deploy the Microsoft-released patch to all affected Office versions using your standard change management process, prioritizing users with elevated privileges or access to sensitive data. Within 30 days, verify complete patch deployment across all endpoints and conduct security awareness training emphasizing the risks of opening documents from untrusted sources.

Microsoft Sharepoint Enterprise Server 2016 EUVD-2026-44215

| CVE-2026-55130 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-14 microsoft

GHSA-p342-gc5g-728w

Buffer Overflow Heap Overflow Microsoft Microsoft Sharepoint Enterprise Server 2016 Microsoft Sharepoint Server 2019 Microsoft Sharepoint Server Subscription Edition Microsoft 365 Apps For Enterprise Microsoft Office Ltsc 2024 Microsoft Office 2019 Microsoft Office Ltsc 2021 Microsoft Word 2016

High

Disputed · 7.8 Vendor: microsoft

Temporal: 6.8

Severity by source

Sources disagree (Medium–Critical)

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:17 vuln.today

CVE Published

Jul 14, 2026 - 17:09 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Word (Office 2016/2019, Microsoft 365 Apps, Office LTSC 2021/2024) arises from a heap-based buffer overflow triggered when a victim opens a maliciously crafted document. An attacker who convinces a user to open a booby-trapped file can run arbitrary code in that user's context, achieving full compromise of confidentiality, integrity, and availability on the host. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, though a vendor patch is available per Microsoft's MSRC advisory.