CVE-2026-55038: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55038 Overview

CVE-2026-55038 is a stack-based buffer overflow vulnerability [CWE-121] in Microsoft Office Word that allows an unauthorized attacker to execute arbitrary code locally. The flaw affects multiple Microsoft Office and Microsoft 365 versions across Windows and macOS, as well as SharePoint Server deployments that render Word documents. Exploitation requires the target user to open a crafted document. Successful exploitation grants the attacker code execution in the context of the current user, which can lead to full compromise of the host when the user holds administrative privileges.

Critical Impact
A crafted Word document can trigger stack memory corruption that yields local code execution across Microsoft 365 Apps, Office 2019, 2021, 2024, Word 2016, and SharePoint Server.

Affected Products

Microsoft 365 Apps (Enterprise x64/x86) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, Office 2024 LTSC (Windows and macOS)
Microsoft Word 2016 and Microsoft SharePoint Server 2016, 2019, and Subscription Edition

Discovery Timeline

2026-07-14 - CVE-2026-55038 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55038

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] within Microsoft Word document parsing routines. When Word processes a specially crafted file, an oversized field is copied into a fixed-size stack buffer without adequate bounds checking. The overflow corrupts adjacent stack data, including saved return addresses and structured exception handler records. An attacker who controls the overflowing content can redirect execution flow and run arbitrary code in the context of the user opening the document. Because SharePoint Server also parses Word documents server-side, the same flaw can be reached through document upload and preview workflows.

Root Cause

The root cause is missing or insufficient validation of a length value in a Word file structure before data is copied to a stack buffer. Word trusts the attacker-supplied size field, which permits a write past the buffer boundary during parsing.

Attack Vector

Exploitation requires local user interaction. The attacker delivers a malicious .doc, .docx, or .rtf file through email, chat, a web download, or a SharePoint document library. When the victim opens or previews the file, Word processes the malformed structure and the overflow is triggered. No authentication is required by the attacker, but the victim must perform the open or preview action.

No public proof-of-concept exploit code has been released for CVE-2026-55038 at the time of publication. Refer to the Microsoft Security Update CVE-2026-55038 advisory for vendor-provided technical detail.

Detection Methods for CVE-2026-55038

Indicators of Compromise

Word (WINWORD.EXE) or SharePoint worker processes spawning command interpreters such as cmd.exe, powershell.exe, wscript.exe, or mshta.exe
Unexpected outbound network connections initiated by WINWORD.EXE shortly after a document is opened
Crash reports referencing stack corruption or access violations in Word parsing modules
Newly written executables, DLLs, or scripts under %APPDATA%, %TEMP%, or user profile directories following document open events

Detection Strategies

Hunt for parent-child process anomalies where Office applications spawn scripting or living-off-the-land binaries
Monitor for suspicious loaded modules and injected threads inside WINWORD.EXE after document open
Inspect inbound email attachments and SharePoint uploads for malformed Word documents using content-disarm or sandbox detonation

Monitoring Recommendations

Enable Windows Defender Application Control or AppLocker logging for Office child processes
Forward Office telemetry, Sysmon process and image-load events, and EDR alerts to a centralized SIEM for correlation
Track SharePoint document parsing failures and worker process crashes that may indicate exploitation attempts

How to Mitigate CVE-2026-55038

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-55038 to all affected Office, Microsoft 365, and SharePoint installations
Enable Protected View and Office Application Guard for documents originating from the internet or email
Block or quarantine inbound Word attachments from untrusted senders at the mail gateway

Patch Information

Microsoft has published fixed builds through the Microsoft Update channel. Administrators should deploy the update to Microsoft 365 Apps (x64/x86 and macOS), Office 2019, Office 2021 LTSC, Office 2024 LTSC, Word 2016, and SharePoint Server 2016, 2019, and Subscription Edition. See the Microsoft Security Update CVE-2026-55038 advisory for build numbers and package identifiers.

Workarounds

Configure Office Attack Surface Reduction (ASR) rules to block child process creation from Office applications
Enforce Protected View for files originating from the internet, unsafe locations, and Outlook attachments
Restrict SharePoint document preview and server-side rendering for untrusted uploads until patches are applied

bash

# Enable ASR rule: Block Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled

# Enforce Protected View via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f