CVE-2026-55033: Microsoft 365 Apps RCE Vulnerability

CVE-2026-55033 Overview

CVE-2026-55033 is a heap-based memory corruption vulnerability in Microsoft Office Word caused by an integer overflow or wraparound [CWE-122]. An attacker who successfully exploits the flaw can execute arbitrary code in the context of the current user. Exploitation requires the target to open a specially crafted document, making phishing and malicious attachment delivery the most likely attack paths.

The vulnerability affects multiple Office releases, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and SharePoint Server. Microsoft published the advisory on July 14, 2026, and the issue remains outside CISA's Known Exploited Vulnerabilities catalog at the time of writing.

Critical Impact
A crafted Word document can trigger arbitrary code execution with the privileges of the current user, enabling initial access, credential theft, or ransomware staging.

Affected Products

Microsoft 365 Apps (x86, x64) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Word 2016 and Microsoft SharePoint Server 2016/2019/Subscription Edition

Discovery Timeline

2026-07-14 - CVE-2026-55033 published to NVD and Microsoft releases security update
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55033

Vulnerability Analysis

The flaw resides in Word's document parsing logic, where an untrusted length or count value is used in arithmetic that wraps around the maximum integer boundary. The resulting undersized allocation is then written to using the original attacker-controlled size, producing a heap buffer overflow classified under [CWE-122].

Because the corruption occurs on the heap, an attacker can shape adjacent allocations to overwrite object pointers, virtual function tables, or metadata. This turns the overflow into a reliable code execution primitive within the WINWORD.EXE process. The user interaction requirement is satisfied by the standard action of opening a document, including previewing certain formats through the Outlook reading pane workflow.

SharePoint Server is affected because it processes Word documents server-side. In that context, exploitation can execute code under the SharePoint service account, expanding the blast radius beyond a single workstation.

Root Cause

The root cause is an integer overflow during size computation for a heap allocation while parsing a Word document structure. When the multiplied or added length fields exceed the maximum representable value, the truncated result bypasses length validation and produces an allocation smaller than the data subsequently copied into it.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a malicious .doc, .docx, .rtf, or related Office file via email, web download, collaboration platform, or SharePoint upload. When the file is opened in a vulnerable Word or SharePoint version, the parser triggers the overflow and executes attacker-supplied shellcode.

No authentication is required for the attacker to prepare the payload, and Office's Protected View may be bypassed if the user selects Enable Editing or if the file is delivered from a trusted zone.

Detection Methods for CVE-2026-55033

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe
Crashes of WINWORD.EXE correlated with opening documents from external senders, visible in Windows Event Log Application entries
Outbound network connections initiated directly by WINWORD.EXE to previously unseen domains or IP addresses
Newly written executables, scripts, or scheduled tasks created in user-writable paths shortly after a Word document is opened

Detection Strategies

Hunt for process lineage where Office applications create scripting or living-off-the-land binaries, mapped to MITRE ATT&CK T1566.001 and T1059
Alert on Word or SharePoint worker processes performing memory allocation failures or exception events consistent with heap corruption
Inspect inbound email and SharePoint uploads for Word documents containing malformed structured storage or oversized embedded objects

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and from injecting code
Forward Sysmon Event IDs 1, 7, 11, and 22 from workstations running Office to a centralized analytics pipeline for behavioral hunting
Monitor SharePoint farm servers for anomalous w3wp.exe behavior tied to Word document rendering endpoints

How to Mitigate CVE-2026-55033

Immediate Actions Required

Apply the July 2026 Microsoft security updates referenced in the Microsoft Security Update CVE-2026-55033 advisory to all Office installations and SharePoint farms
Prioritize patching internet-facing SharePoint servers and endpoints belonging to users who routinely handle external documents
Confirm that Microsoft 365 Apps clients are on a supported update channel and have received the current build

Patch Information

Microsoft addressed CVE-2026-55033 in security updates released on July 14, 2026. Refer to the Microsoft Security Update CVE-2026-55033 guide for the specific KB numbers and build versions that apply to Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, Word 2016, and SharePoint Server.

Workarounds

Enforce Protected View and Office File Block policy to prevent legacy Word formats from opening outside a sandbox until patching is complete
Disable the Outlook preview pane for external mail to reduce automatic parsing of untrusted attachments
Restrict SharePoint document upload and rendering to authenticated internal users pending validation of applied updates

bash

# Example Group Policy registry keys to enforce Protected View for Word
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f