CVE-2026-55028: Microsoft 365 Apps Info Disclosure Flaw

CVE-2026-55028 Overview

CVE-2026-55028 is an out-of-bounds read vulnerability [CWE-125] affecting multiple versions of Microsoft Office and SharePoint Server. The flaw allows an unauthorized attacker to disclose information locally after convincing a user to open a crafted document. Exploitation requires local access and user interaction, but no authentication is needed. Successful exploitation exposes sensitive memory contents from the Office process, which may include data from other documents, session artifacts, or memory layout information useful for chaining with other vulnerabilities.

Microsoft published the advisory on July 14, 2026, covering Office 2016, 2019, 2021, 2024, Microsoft 365 Apps, and SharePoint Server subscription, 2016, and 2019 editions.

Critical Impact
Attackers can read sensitive process memory from Microsoft Office by inducing a user to open a malicious document, potentially leaking confidential data across the enterprise Office and SharePoint footprint.

Affected Products

Microsoft 365 Apps (Enterprise x64/x86) and Microsoft 365 for macOS
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows and macOS)
Microsoft SharePoint Server Subscription Edition, 2019, and 2016 Enterprise

Discovery Timeline

2026-07-14 - CVE-2026-55028 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55028

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] within Microsoft Office file parsing routines. When Office processes a specially crafted document, the parser reads memory beyond the bounds of an allocated buffer. The disclosed bytes are returned into structures the attacker can later observe, resulting in information disclosure from the Office process address space.

The issue affects both the Windows and macOS builds of Microsoft 365, indicating the defect resides in shared cross-platform parsing logic. SharePoint Server is also affected because the same document parsing components run server-side when documents are ingested or previewed.

Exploitation is confined to information disclosure. The scope is unchanged, integrity is not affected, and availability is not impacted. However, leaked memory can include address values that defeat Address Space Layout Randomization (ASLR) in a follow-on remote code execution chain.

Root Cause

The root cause is missing or insufficient bounds validation when parsing attacker-controlled fields inside an Office document. The parser calculates a read offset or length from data within the file without verifying that the resulting range lies inside the allocated buffer. Microsoft has not published implementation-level details, and no public proof-of-concept exists.

Attack Vector

The attack requires local delivery of a malicious document and active user interaction to open it. Typical delivery channels include phishing email attachments, malicious SharePoint uploads, and drive-by document downloads. Once the document is opened in a vulnerable Office application, the parser triggers the out-of-bounds read and returns memory contents accessible to the attacker.

No verified exploit code is publicly available. The EPSS probability is 0.382% at the 30th percentile, indicating low near-term exploitation likelihood. Refer to the Microsoft Security Update CVE-2026-55028 advisory for vendor-supplied technical context.

Detection Methods for CVE-2026-55028

Indicators of Compromise

Microsoft Office processes (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) crashing or generating Windows Error Reporting entries when opening documents from untrusted sources.
Office documents received via email or downloaded from external SharePoint sites that contain malformed structured storage streams or unusual embedded objects.
Unexpected outbound network connections initiated by Office processes shortly after opening a document, potentially exfiltrating leaked memory contents.

Detection Strategies

Monitor Office application telemetry for abnormal read patterns, access violations, or exception handlers triggered during document parsing.
Inspect email gateways and SharePoint ingestion pipelines for documents with malformed metadata or oversized structured fields that could trigger the parser flaw.
Correlate document-open events with subsequent process behavior such as child process creation, script host invocation, or DNS queries to previously unseen domains.

Monitoring Recommendations

Enable Microsoft Office diagnostic logging and forward crash telemetry to a central SIEM for correlation.
Track patch compliance across all Office channels (Current, Monthly Enterprise, Semi-Annual) and SharePoint farms to identify unpatched endpoints.
Alert on documents originating from external senders that are opened by users in high-value roles such as finance, legal, or executive staff.

How to Mitigate CVE-2026-55028

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Update CVE-2026-55028 advisory to all Office and SharePoint installations.
Prioritize patching of internet-facing SharePoint Server instances and endpoints belonging to users who frequently handle external documents.
Reinforce user awareness that documents from untrusted sources should be opened in Protected View or not opened at all.

Patch Information

Microsoft has published fixes through the standard update channels for Microsoft 365 Apps, Office 2016, 2019, 2021 LTSC, 2024 LTSC (including macOS builds), and SharePoint Server Subscription Edition, 2019, and 2016. Consult the Microsoft Security Update CVE-2026-55028 page for build numbers specific to each channel and platform.

Workarounds

Enforce Office Protected View for files originating from the internet and Outlook attachments, which sandboxes document parsing.
Configure Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and injecting into other processes.
Restrict inbound Office document formats at the mail gateway or convert them to PDF for preview when full editing is not required.

bash

# Verify Protected View settings via PowerShell registry query
Get-ItemProperty -Path 'HKCU:\Software\Microsoft\Office\16.0\Word\Security\ProtectedView' `
  -Name DisableInternetFilesInPV, DisableAttachmentsInPV, DisableUnsafeLocationsInPV

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions Enabled