CVE-2026-55017: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55017 Overview

CVE-2026-55017 is a heap-based buffer overflow vulnerability [CWE-122] affecting multiple versions of Microsoft Office. An attacker can execute arbitrary code locally when a user opens a crafted Office document. The flaw impacts Microsoft 365 Apps, Office 2016, Office 2019, Office 2021, and Office 2024 on both x86 and x64 architectures.

Exploitation requires user interaction but no prior authentication. Successful attacks compromise confidentiality, integrity, and availability of the affected system in the context of the current user. Microsoft published the advisory on July 14, 2026, and the vulnerability affects all installations that have not received the corresponding security update.

Critical Impact
Attackers can achieve local code execution in the context of the Office user by delivering a malicious document, enabling initial access, credential theft, or further lateral movement.

Affected Products

Microsoft 365 Apps (Enterprise, x86 and x64)
Microsoft Office 2016 and Office 2019 (x86 and x64)
Microsoft Office 2021 LTSC and Office 2024 LTSC (x86 and x64)

Discovery Timeline

2026-07-14 - Microsoft published security advisory for CVE-2026-55017
2026-07-14 - CVE-2026-55017 published to the National Vulnerability Database
2026-07-16 - Last updated in the NVD database

Technical Details for CVE-2026-55017

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Microsoft Office document parsing routines. When Office processes a specially crafted file, it writes past the bounds of a heap-allocated buffer. This overflow corrupts adjacent heap metadata or object pointers, which an attacker can leverage to hijack control flow.

Because the flaw executes within the Office process, attackers gain code execution at the privilege level of the logged-on user. Standard users are exposed, and administrative accounts amplify the resulting impact. The attack chain typically requires the victim to open a weaponized document delivered via email, web download, or a shared file location.

Root Cause

The root cause is improper validation of size or length values during heap allocation and subsequent data copy operations, categorized under [CWE-122] Heap-based Buffer Overflow. A malformed structure inside an Office document supplies a length that does not match the destination buffer, causing an out-of-bounds write on the heap. Microsoft has not publicly disclosed the specific file format or parser component involved.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious Office document and delivers it through phishing, drive-by download, or a compromised file share. When the user opens the document, the parser triggers the overflow and executes attacker-supplied shellcode within the Office process.

No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability at time of publication is 0.303%.

// No verified public exploit code is available for CVE-2026-55017.
// See the Microsoft Security Response Center advisory for technical details:
// https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55017

Detection Methods for CVE-2026-55017

Indicators of Compromise

Unexpected child processes spawned by winword.exe, excel.exe, powerpnt.exe, or outlook.exe, such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Office applications crashing repeatedly with access violation exceptions when opening specific documents.
Outbound network connections initiated directly by Office processes to unfamiliar hosts.
Newly written executable or script files in %APPDATA%, %TEMP%, or %LOCALAPPDATA% immediately after opening a document.

Detection Strategies

Hunt for Office processes writing executable content to disk or loading unsigned DLLs from user-writable paths.
Correlate email gateway logs with endpoint telemetry to identify documents that trigger anomalous Office behavior.
Apply YARA rules against inbound attachments that target malformed structures in Office file formats.
Enable Microsoft Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and executable content.

Monitoring Recommendations

Forward Sysmon and Microsoft Defender telemetry to a centralized SIEM for cross-endpoint correlation of Office-originated process creation events.
Alert on high-volume opens of documents from external senders across multiple users, which can indicate a phishing campaign.
Track Office application version and patch level across the fleet to prioritize unpatched hosts for investigation.

How to Mitigate CVE-2026-55017

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-55017 to all affected Office installations.
Prioritize patching for users who routinely handle documents from external sources, including finance, HR, and executive assistants.
Enable Protected View and Office Application Guard where supported to sandbox untrusted documents.
Block or quarantine Office documents received from untrusted external senders at the email gateway until patching is complete.

Patch Information

Microsoft has released fixes for all supported channels of Microsoft 365 Apps, Office 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC. Refer to the Microsoft Security Update for CVE-2026-55017 for the specific build numbers and update packages that address the vulnerability across x86 and x64 architectures.

Workarounds

Enforce Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and executable content.
Configure Group Policy to disable macros and require Protected View for files originating from the internet or from untrusted locations.
Restrict user permissions so that Office runs under a standard, non-administrative account, limiting the impact of local code execution.

bash

# Example: Enable ASR rules via PowerShell to reduce Office attack surface
# Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled

# Block Office applications from creating executable content
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  3B576869-A4EC-4529-8536-B80A7769E899 `
  -AttackSurfaceReductionRules_Actions Enabled

# Block Win32 API calls from Office macros
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B `
  -AttackSurfaceReductionRules_Actions Enabled