CVE-2026-55035 Overview
CVE-2026-55035 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office that allows an unauthorized attacker to disclose information locally. The flaw affects multiple supported Office releases, including Microsoft 365 Apps, Office 2016, 2019, 2021, and 2024, along with SharePoint Server. Exploitation requires user interaction, such as opening a crafted document, and delivers limited confidentiality impact with no direct effect on integrity or availability. Microsoft published an advisory for this issue in July 2026.
Critical Impact
Successful exploitation exposes small amounts of process memory to an attacker, which can leak sensitive data such as pointers, tokens, or document fragments that aid follow-on attacks.
Affected Products
- Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
- Microsoft Office 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024 (Windows and macOS)
- Microsoft SharePoint Server Subscription Edition, SharePoint Server 2016 Enterprise, and SharePoint Server 2019
Discovery Timeline
- 2026-07-14 - CVE-2026-55035 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-55035
Vulnerability Analysis
The issue is an out-of-bounds read in Microsoft Office parsing logic. When Office processes a specially crafted file, the affected code path reads memory beyond the intended buffer boundary. The read operation returns adjacent process memory to a code path that ultimately exposes it to the attacker.
Exploitation is local and requires the victim to open a malicious document. The scope is unchanged and the attacker gains only low-impact confidentiality disclosure, with no integrity or availability impact. The vulnerability does not permit code execution on its own, but leaked memory content can be paired with other flaws to defeat mitigations such as Address Space Layout Randomization (ASLR).
At the time of publication, no public proof-of-concept exists, the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.
Root Cause
The root cause is missing or incorrect bounds checking on a length or offset field parsed from an untrusted Office document. The parser dereferences an index that exceeds the allocated buffer, returning uninitialized or adjacent heap data to caller logic that surfaces it through the document rendering pipeline.
Attack Vector
An attacker crafts a malicious Office file and delivers it through email, chat, a web download, or a compromised SharePoint site. When a user opens the file in a vulnerable Office client, the parser triggers the out-of-bounds read and exposes memory contents. No elevated privileges are required, but user interaction is mandatory.
// No verified public proof-of-concept is available for CVE-2026-55035.
// Refer to the Microsoft Security Response Center advisory for technical details.
Detection Methods for CVE-2026-55035
Indicators of Compromise
- Unexpected Office documents originating from external senders that reference unusual embedded objects, custom XML parts, or malformed structures
- Office application crashes or Windows Error Reporting entries referencing winword.exe, excel.exe, or powerpnt.exe when opening specific files
- Outbound network activity from an Office process shortly after a document is opened, suggesting exfiltration of leaked data
Detection Strategies
- Inspect inbound email attachments and SharePoint uploads with a sandbox that opens Office documents and monitors for abnormal memory access patterns
- Correlate Office process crashes with the file hash and sender identity to identify targeted delivery attempts
- Hunt for child processes or script interpreters spawned by Office after opening untrusted files, which often accompany information-disclosure chains
Monitoring Recommendations
- Enable Microsoft Defender for Office 365 Safe Attachments or an equivalent detonation service on all inbound mail flow
- Forward Office telemetry, Windows Error Reporting, and Sysmon process events to a centralized analytics platform for correlation
- Track Office client build numbers across the fleet to confirm the July 2026 security update is deployed
How to Mitigate CVE-2026-55035
Immediate Actions Required
- Apply the Microsoft July 2026 security updates to all affected Office and SharePoint Server versions listed in the advisory
- Prioritize patching endpoints used by high-value users who routinely open documents from external parties
- Block or quarantine Office documents from untrusted senders until updates are confirmed installed
Patch Information
Microsoft addressed the vulnerability through security updates released via the standard Office and SharePoint servicing channels. Full remediation details are available in the Microsoft CVE-2026-55035 Advisory.
Workarounds
- Enable Protected View for files originating from the internet and other untrusted locations
- Enforce Office Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting into other processes
- Restrict macro execution and use Group Policy to disable legacy file format opening where operationally feasible
# Example: enforce Protected View for internet-sourced files via Group Policy registry keys
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
