CVE-2026-55045: Microsoft 365 Apps RCE Vulnerability

CVE-2026-55045 Overview

CVE-2026-55045 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office that allows an unauthorized attacker to execute code locally. The flaw affects a broad range of Microsoft productivity products, including Microsoft 365 Apps, Office 2016 through 2024, and SharePoint Server. Successful exploitation results in high impact to confidentiality, integrity, and availability on the targeted system. Microsoft published the advisory on July 14, 2026, and the issue does not require prior authentication or user interaction according to the CVSS vector.

Critical Impact
An attacker who successfully exploits CVE-2026-55045 can read memory outside the intended buffer in Microsoft Office, leading to arbitrary local code execution with full compromise of the affected process.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86) and Microsoft 365 for macOS
Microsoft Office 2016, Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft SharePoint Server 2016, 2019, and Subscription Edition

Discovery Timeline

2026-07-14 - CVE-2026-55045 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55045

Vulnerability Analysis

CVE-2026-55045 is classified under [CWE-125] Out-of-Bounds Read. The vulnerability occurs when Microsoft Office parses a specially crafted document and reads memory beyond the boundary of an allocated buffer. This condition can leak adjacent memory contents and, under specific memory layouts, corrupt program state sufficiently to redirect execution.

Despite the Local attack vector classification in the CVSS metrics, the exploitation pattern for Office out-of-bounds read issues typically involves an attacker delivering a malicious document that a user opens on the target host. Once opened, the parser processes attacker-controlled structures and triggers the flaw. The result is code execution in the context of the current user, which can be leveraged to install malware, harvest credentials, or pivot to other systems.

The scope is unchanged, meaning exploitation impacts only the vulnerable Office process and its user context, but that context is frequently sufficient for follow-on compromise.

Root Cause

The root cause is missing or insufficient bounds validation within an Office file format parser. When a malformed structure specifies a size or offset that exceeds the allocated region, the parser dereferences memory beyond the buffer boundary. Microsoft has not published detailed technical internals for this issue at the time of writing.

Attack Vector

Exploitation requires the target to process a malicious file with a vulnerable version of Office or SharePoint Server. In desktop scenarios, delivery vectors include email attachments, malicious downloads, and shared network locations. On SharePoint Server, ingestion of a crafted document into a document library or through server-side rendering can trigger the parser on the server itself.

The vulnerability mechanism is documented at the Microsoft CVE-2026-55045 Advisory. No public proof-of-concept code is available, and the EPSS data indicates a low near-term probability of observed exploitation.

Detection Methods for CVE-2026-55045

Indicators of Compromise

Unexpected child processes spawned by winword.exe, excel.exe, powerpnt.exe, or outlook.exe, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Office application crashes (Application Error events with faulting module tied to Office parsers) followed by suspicious file writes to %APPDATA% or %TEMP%.
Unusual outbound network connections initiated directly from Office processes to previously unseen domains or IP addresses.

Detection Strategies

Monitor process ancestry to flag Office applications launching scripting hosts, LOLBins, or unsigned binaries.
Inspect inbound documents at mail and web gateways for anomalies in Office Open XML structures, embedded objects, and oversized or malformed records.
On SharePoint Server, alert on parser exceptions in ULS logs correlated with document uploads from external or low-reputation identities.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and injecting into other processes.
Forward Office telemetry, Sysmon process and image-load events, and SharePoint ULS logs to a centralized analytics platform for correlation.
Track patch deployment status across all endpoints and SharePoint farms to identify unpatched hosts that require prioritized remediation.

How to Mitigate CVE-2026-55045

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft CVE-2026-55045 Advisory to all affected Office and SharePoint installations.
Prioritize patching for internet-exposed SharePoint Servers and endpoints used by high-value users such as administrators and executives.
Instruct users to avoid opening Office documents from untrusted sources until updates are verified.

Patch Information

Microsoft has released security updates for Microsoft 365 Apps, Office 2016, Office 2019, Office 2021 LTSC, Office 2024 LTSC, Microsoft 365 for macOS, and SharePoint Server 2016, 2019, and Subscription Edition. Consult the Microsoft CVE-2026-55045 Advisory for build numbers and deployment guidance specific to each channel.

Workarounds

Enable Protected View and Office Application Guard so that documents from the internet or email attachments open in an isolated container.
Configure Group Policy to block macros and ActiveX controls in files originating from the internet.
Enforce Attack Surface Reduction rules that prevent Office child process creation and executable content from email clients or webmail.

bash

# Enable ASR rule: Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Enable ASR rule: Block Office applications from injecting code into other processes
Set-MpPreference -AttackSurfaceReductionRules_Ids 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
                 -AttackSurfaceReductionRules_Actions Enabled