CVE-2026-55027: Microsoft 365 Apps Info Disclosure Flaw

CVE-2026-55027 Overview

CVE-2026-55027 is an out-of-bounds read vulnerability [CWE-125] affecting multiple Microsoft Office products. An unauthorized attacker can leverage the flaw to disclose information locally when a user opens a specially crafted document. The vulnerability affects Microsoft 365 Apps, Microsoft 365 for macOS, Office 2016, Office 2019, Office 2021, Office 2024, and SharePoint Server 2016, 2019, and Subscription Edition. Exploitation requires user interaction but no privileges, making phishing-delivered documents a viable delivery method.

Critical Impact
Successful exploitation exposes sensitive process memory contents to an attacker, which can include cryptographic material, document data, or memory addresses useful for bypassing exploit mitigations.

Affected Products

Microsoft 365 Apps (Enterprise x86/x64) and Microsoft 365 for macOS
Microsoft Office 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS variants)
Microsoft SharePoint Server 2016, 2019, and Subscription Edition

Discovery Timeline

2026-07-14 - CVE-2026-55027 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55027

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the Microsoft Office parsing logic. When Office processes a malformed document, the affected code path reads memory beyond the intended buffer boundary. The disclosed memory can be returned to the attacker through document rendering artifacts or subsequent file operations. Confidentiality impact is high while integrity and availability are unaffected, consistent with a pure information-disclosure primitive.

Because the flaw resides in shared Office parsing components, it spans desktop Office versions, Microsoft 365 Apps, and SharePoint Server, which uses the same parsing stack for server-side document handling.

Root Cause

The root cause is missing or incorrect bounds validation when the parser reads structured fields from a document. The parser trusts a length or offset value from the file and reads beyond the end of an allocated buffer. This class of defect maps directly to [CWE-125] Out-of-bounds Read.

Attack Vector

Attack complexity is low and no authentication is required, but user interaction is mandatory. A typical attack chain involves an attacker crafting a malicious Office document and delivering it through email or a web download. When the user opens the document in a vulnerable Office application, the parser triggers the out-of-bounds read. The leaked memory can then be exfiltrated to the attacker, either directly through document content or paired with a companion vulnerability to achieve broader compromise.

No public proof-of-concept or in-the-wild exploitation has been reported at time of publication. See the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-55027

Indicators of Compromise

Office documents containing malformed structured fields or unusually large offset values that trigger parser anomalies.
Office application crashes, hangs, or Windows Error Reporting entries generated shortly after opening a document from an untrusted source.
Outbound network connections initiated by WINWORD.EXE, EXCEL.EXE, or POWERPNT.EXE to unknown destinations after document open events.

Detection Strategies

Hunt for Office processes spawning unusual child processes or performing memory-intensive read operations immediately after opening attachments.
Correlate email gateway telemetry with endpoint document-open events to identify recipients of suspicious Office files.
Inspect SharePoint Server logs for document processing errors or exceptions from the Office file parsers.

Monitoring Recommendations

Enable Attack Surface Reduction (ASR) rules that block Office child process creation and log rule triggers to a central SIEM.
Monitor for high-volume delivery of Office attachments from external senders to broad recipient lists, a common phishing pattern.
Track patch compliance across Microsoft 365 Apps, Office LTSC versions, and SharePoint Server hosts to identify unpatched systems.

How to Mitigate CVE-2026-55027

Immediate Actions Required

Apply the security updates referenced in the Microsoft Security Update Guide to all affected Office and SharePoint installations.
Prioritize patching for endpoints belonging to high-risk users such as executives, finance, and IT administrators.
Update SharePoint Server instances that process externally sourced documents before addressing lower-exposure hosts.

Patch Information

Microsoft has issued fixes through the standard security update channels for Microsoft 365 Apps, Office 2016, 2019, 2021, 2024, and SharePoint Server. Refer to the Microsoft Security Update Guide for the specific KB numbers and build versions that remediate CVE-2026-55027.

Workarounds

Enable Protected View and Office Application Guard so that documents from the internet open in an isolated container.
Configure Group Policy to block macros in Office files originating from the internet and enforce Mark-of-the-Web propagation.
Restrict document delivery from untrusted senders through email gateway policies and disable automatic previewing of Office attachments.

bash

# Configuration example: enforce Protected View for internet-sourced Office files via registry
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f