CVE-2026-55032: Microsoft 365 Apps Use-After-Free Flaw

CVE-2026-55032 Overview

CVE-2026-55032 is a use-after-free vulnerability [CWE-416] in Microsoft Office Word that allows an unauthorized attacker to execute code locally on affected systems. The flaw affects multiple Microsoft Office product lines, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, Word 2016, and SharePoint Server. Exploitation requires user interaction, typically by opening a crafted Word document. Successful exploitation grants attackers the ability to execute arbitrary code in the context of the current user.

Critical Impact
An attacker who successfully exploits CVE-2026-55032 can execute arbitrary code locally with the privileges of the user opening a malicious document, enabling malware installation, data theft, and lateral movement.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Word 2016 and SharePoint Server 2016, 2019, and Subscription Edition

Discovery Timeline

2026-07-14 - CVE-2026-55032 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55032

Vulnerability Analysis

CVE-2026-55032 is classified as a use-after-free condition within Microsoft Office Word's document processing logic. Use-after-free vulnerabilities occur when a program continues to reference memory after it has been freed, allowing attackers to manipulate the freed memory region to influence program flow. In Word, this class of bug frequently arises during parsing of complex document structures such as embedded objects, OLE streams, or field codes. An attacker who controls the layout of the freed heap chunk can redirect execution to attacker-controlled data, achieving arbitrary code execution in the Word process.

Root Cause

The root cause is improper memory lifecycle management inside Word's parser. An object is freed while another code path retains a dangling pointer to the same memory. Subsequent dereference of that pointer, after the heap slot has been reallocated with attacker-controlled data, results in corruption of program state and execution flow.

Attack Vector

Exploitation is local and requires user interaction. An attacker crafts a malicious Word document and delivers it via email, web download, or a shared SharePoint location. When the victim opens the document in a vulnerable version of Word, the parser triggers the use-after-free condition. Preview Pane rendering may also serve as a trigger vector for similar Word memory corruption bugs. Code executes with the privileges of the current user.

No verified public proof-of-concept code is available for CVE-2026-55032 at publication time. See the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-55032

Indicators of Compromise

Unexpected child processes spawned by winword.exe, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Word documents (.docx, .doc, .rtf) delivered via email or download that crash Word or trigger Protected View bypass attempts.
Outbound network connections initiated by winword.exe to unfamiliar or newly registered domains shortly after document open.
Creation of executable files or scripts in user-writable paths such as %APPDATA%, %TEMP%, or %LOCALAPPDATA% following a Word session.

Detection Strategies

Hunt for process lineage where winword.exe is the parent of scripting or LOLBin executables, a strong signal for Office exploitation.
Monitor Windows Error Reporting and application crash telemetry for repeated winword.exe faults with heap corruption exception codes such as 0xC0000374 or 0xC0000005.
Correlate opening of newly delivered Word documents with subsequent persistence artifacts, including Run key modifications and scheduled task creation.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting into other processes.
Ingest endpoint process telemetry, Office telemetry, and email gateway logs into a central analytics platform for cross-source correlation.
Alert on documents originating from external senders that contain embedded OLE objects, macros, or unusual field codes.

How to Mitigate CVE-2026-55032

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-55032 across all affected Office and SharePoint deployments as documented in the Microsoft Security Update Guide.
Prioritize patching of endpoints used by high-risk users, including executives, finance staff, and IT administrators.
Verify that Microsoft 365 Apps auto-update channels have delivered the fixed build to all managed devices.

Patch Information

Microsoft has released updates for Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, Word 2016, and SharePoint Server. Refer to the Microsoft Security Update Guide for build numbers and KB articles specific to each product and channel.

Workarounds

Enforce Protected View and Office Application Guard for documents originating from the internet or email attachments.
Block or quarantine inbound Word documents from untrusted senders at the mail gateway until patching is confirmed.
Disable the Outlook Preview Pane and the Windows Explorer preview handler for Office file types on high-risk endpoints.

bash

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Enable ASR rule: Block Office applications from injecting code into other processes
Set-MpPreference -AttackSurfaceReductionRules_Ids 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 -AttackSurfaceReductionRules_Actions Enabled

# Verify Microsoft 365 Apps update channel and build
reg query "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /v VersionToReport