CVE-2026-55023: Microsoft 365 Apps Information Disclosure

CVE-2026-55023 Overview

CVE-2026-55023 is an out-of-bounds read vulnerability [CWE-125] affecting multiple versions of Microsoft Office and SharePoint Server. The flaw allows an unauthorized attacker to disclose information locally when a user opens a specially crafted file. Exploitation requires user interaction but no authentication, and the attacker can read memory content beyond the intended buffer boundary. Microsoft assigned this issue a CVSS 3.1 base score of 5.5 with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, reflecting high confidentiality impact without integrity or availability consequences.

Critical Impact
Successful exploitation can leak sensitive process memory content from Microsoft Office applications, potentially exposing document data, credentials, or address space information usable in follow-on attacks.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86) and Microsoft 365 for macOS
Microsoft Office 2016, Office 2019, Office 2021 (LTSC, including macOS), and Office 2024 (LTSC, including macOS)
Microsoft SharePoint Server Subscription Edition, SharePoint Server 2016 Enterprise, and SharePoint Server 2019

Discovery Timeline

2026-07-14 - CVE-2026-55023 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55023

Vulnerability Analysis

The vulnerability is an out-of-bounds read condition in Microsoft Office file parsing routines. When Office loads a malformed document, the parser reads memory beyond the allocated buffer boundary. The returned bytes can include adjacent heap or stack content belonging to the Office process. Attackers use this leaked content to disclose sensitive information or to defeat address space layout randomization (ASLR) as a preparatory step for further exploitation.

The scope covers desktop Office builds on Windows and macOS as well as server-side rendering through SharePoint Server. Because SharePoint processes uploaded documents server-side, the same parser code path is reachable by any authenticated content contributor on affected SharePoint deployments.

Root Cause

The root cause is missing or insufficient bounds validation during parsing of an untrusted file structure. The vulnerable code trusts a length or offset field from the document without confirming it falls within the allocated buffer. Weaknesses of this class map to [CWE-125] Out-of-bounds Read.

Attack Vector

The attack vector is local (AV:L) and requires user interaction (UI:R). An attacker delivers a crafted Office document through email, a web download, or a shared file location. When the target opens the document in an affected Office client, the parser triggers the out-of-bounds read and returns memory content to attacker-controlled fields. No privileges are required prior to exploitation.

Refer to the Microsoft Security Update CVE-2026-55023 advisory for authoritative technical details. No public proof-of-concept exploit and no in-the-wild exploitation have been reported at the time of publication.

Detection Methods for CVE-2026-55023

Indicators of Compromise

Office documents from untrusted sources containing malformed structures that cause WINWORD.EXE, EXCEL.EXE, or POWERPNT.EXE to crash or generate Windows Error Reporting entries
Unexpected outbound network connections initiated by Office processes shortly after a document is opened
SharePoint worker processes (w3wp.exe) generating parser exceptions when rendering user-uploaded documents

Detection Strategies

Hunt for anomalous child processes or memory access patterns spawned by Office applications, correlated with recent document open events
Inspect email gateways and file share telemetry for Office documents flagged by static analyzers as containing malformed or oversized structure fields
Monitor endpoint EDR telemetry for Office process crashes tied to file-parsing modules, which can indicate exploitation attempts against out-of-bounds read conditions

Monitoring Recommendations

Enable and forward Microsoft Office telemetry, Windows Error Reporting, and AMSI logs to a centralized analytics platform for correlation
Track SharePoint document upload and rendering events, especially from external or newly onboarded accounts
Baseline normal Office process behavior so that memory read anomalies and exception patterns produce actionable alerts

How to Mitigate CVE-2026-55023

Immediate Actions Required

Apply the security updates listed in the Microsoft Security Response Center advisory for all affected Office and SharePoint Server builds
Prioritize patching of SharePoint Server instances that accept document uploads from external users
Restrict opening of Office documents originating from untrusted email attachments and web downloads until patching is complete

Patch Information

Microsoft has published the fix through the standard Microsoft Update channel. Administrators should consult the Microsoft Security Update CVE-2026-55023 advisory for build numbers, KB identifiers, and deployment guidance covering Microsoft 365 Apps, Office 2016 through 2024, and SharePoint Server editions.

Workarounds

Enable Protected View and Office Application Guard so that untrusted documents open in an isolated container
Use Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and from injecting into other processes
Configure Group Policy to block macros and active content in files originating from the internet, reducing the delivery surface for weaponized documents

bash

# Example: enable ASR rule to block Office child process creation
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled