CVE-2026-55047: Microsoft 365 Apps Info Disclosure Flaw

CVE-2026-55047 Overview

CVE-2026-55047 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office that permits an unauthorized attacker to disclose information locally. The flaw affects multiple Office product lines, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, Office Online Server, and SharePoint Server. Exploitation requires user interaction, typically by opening a specially crafted document. Successful exploitation exposes memory contents that may contain sensitive data such as pointers, tokens, or fragments of other documents.

Critical Impact
An attacker who convinces a user to open a crafted Office file can read out-of-bounds memory, potentially leaking sensitive information that assists in follow-on attacks.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Office Online Server and SharePoint Server (2016, 2019, and Subscription Edition)

Discovery Timeline

2026-07-14 - CVE-2026-55047 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55047

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] within Microsoft Office file parsing logic. When Office processes a malformed document, the parser reads beyond the bounds of an allocated buffer. The returned memory may contain adjacent process data unrelated to the document, including heap metadata, pointers, or residual content from other files. The result is unauthorized information disclosure limited to confidentiality, with no direct impact to integrity or availability.

The issue requires local user interaction, meaning the target must open the attacker-supplied file within a vulnerable Office application. No elevated privileges are required to trigger the condition. Because the affected surface includes SharePoint Server and Office Online Server, server-side rendering of a hostile document could also expose process memory from the service account context.

Root Cause

The root cause is missing or insufficient bounds checking during structured document parsing. A crafted record specifies a length or offset that the parser trusts without validation against the actual buffer size. The read operation then extends past the allocation, returning uninitialized or unrelated memory to caller logic that surfaces or persists that data.

Attack Vector

Exploitation is local and requires user interaction. An attacker crafts a malicious Office document (for example, a Word, Excel, or PowerPoint file) and delivers it via email, shared drive, or web download. When the victim opens the file in a vulnerable Office client, or when a SharePoint or Office Online Server instance renders the file, the parser triggers the out-of-bounds read. Attackers commonly chain such disclosure flaws with memory corruption bugs to bypass ASLR or leak secrets useful for further compromise.

No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.

Detection Methods for CVE-2026-55047

Indicators of Compromise

Unexpected Office documents received from untrusted senders, particularly with unusual embedded objects or malformed structures
Office application crashes or Windows Error Reporting events (AppCrash) tied to WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, or SharePoint worker processes shortly after opening a document
Anomalous outbound network traffic from Office processes following document open events

Detection Strategies

Inspect email gateways and file shares for Office documents containing malformed OLE, OOXML, or RTF structures that fail schema validation
Correlate process telemetry that shows Office applications spawning script interpreters (cmd.exe, powershell.exe, wscript.exe) after opening documents
Enable Microsoft Defender AMSI integration and Office attack surface reduction (ASR) rules to log suspicious document behavior

Monitoring Recommendations

Monitor SharePoint and Office Online Server application logs for parser exceptions and worker process restarts
Track EDR telemetry for memory-read anomalies and repeated crashes originating from Office document parsers
Alert on Office processes reading or transmitting unusual volumes of memory-resident data to external destinations

How to Mitigate CVE-2026-55047

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-55047 advisory to all affected Office and SharePoint installations
Prioritize patching SharePoint Server and Office Online Server first, as server-side document rendering broadens the exposed attack surface
Enforce Protected View and Block macros from the internet policies for all Office clients

Patch Information

Microsoft has released security updates addressing CVE-2026-55047 across Microsoft 365 Apps, Office 2019, Office 2021 LTSC, Office 2024 LTSC, Microsoft 365 for macOS, Office Online Server, and SharePoint Server 2016, 2019, and Subscription Edition. Refer to the Microsoft Security Update CVE-2026-55047 advisory for the specific build numbers and Click-to-Run channels.

Workarounds

Configure Office File Block policy to prevent opening legacy or untrusted file formats until patches are applied
Restrict SharePoint and Office Online Server document rendering to authenticated internal users only
Deploy application allowlisting and disable Office add-ins from untrusted publishers to reduce exposure

bash

# Example Group Policy registry setting to enforce Protected View for files from the internet
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f