CVE-2026-55055: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55055 Overview

CVE-2026-55055 is a stack-based buffer overflow [CWE-121] in Microsoft Office Word that permits local code execution. An unauthorized attacker can craft a malicious document that, when opened by a user, overwrites stack memory and executes arbitrary code in the context of the current user. The flaw affects multiple Office builds, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, Word 2016, Microsoft 365 for macOS, and SharePoint Server deployments that render Word content. Exploitation requires user interaction, typically through opening or previewing a weaponized .doc or .docx file delivered via email, web download, or shared storage.

Critical Impact
Successful exploitation grants attackers the ability to execute arbitrary code with the privileges of the current user, enabling malware deployment, credential theft, and lateral movement.

Affected Products

Microsoft 365 Apps (x64 and x86 enterprise editions) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Word 2016 and Microsoft SharePoint Server 2016, 2019, and Subscription Edition

Discovery Timeline

2026-07-14 - CVE-2026-55055 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55055

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow classified under [CWE-121] within Microsoft Word's document parsing routines. When Word processes a specially crafted file, it writes attacker-controlled data past the boundary of a fixed-size stack buffer. This overwrite can corrupt adjacent stack variables, saved return addresses, and structured exception handler records.

An attacker who controls the overwritten data can redirect execution flow to shellcode or reuse existing code through return-oriented programming. Because Word runs in the context of the logged-in user, code executes with that user's permissions. On systems where users hold administrative privileges, attackers gain full control of the endpoint.

SharePoint Server is also affected because it invokes Word document processing components when handling uploaded content and rendering previews.

Root Cause

The root cause is missing or incorrect bounds validation when copying document-derived data into a stack-allocated buffer inside Word's file parser. A field length, record count, or embedded object size supplied by the document is trusted without validation, allowing a copy operation to exceed the destination buffer.

Attack Vector

The attack vector is local and requires user interaction. A common delivery chain involves phishing emails carrying a malicious document, or web links that trigger the download and opening of a crafted Word file. On SharePoint Server, an attacker with upload rights can stage a file that triggers the vulnerability during server-side rendering or preview generation. The Preview Pane in Windows Explorer and Outlook can also serve as a trigger surface for Word documents.

No verified public proof-of-concept code is available at the time of publication. Refer to the Microsoft Security Update Guide for authoritative technical detail.

Detection Methods for CVE-2026-55055

Indicators of Compromise

WINWORD.EXE spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, mshta.exe, or rundll32.exe
Word process crashes with exception codes indicative of stack corruption, such as 0xC0000409 (STATUS_STACK_BUFFER_OVERRUN) recorded in the Windows Application event log
Outbound network connections initiated by WINWORD.EXE to previously unseen or low-reputation domains shortly after a document is opened
New persistence artifacts, such as scheduled tasks or Run registry keys, created within seconds of a Word document being opened

Detection Strategies

Hunt for anomalous process ancestry where Office binaries create scripting interpreters or LOLBins, aligned with MITRE ATT&CK technique T1566.001
Inspect email gateways and file shares for .doc, .docx, .docm, and .rtf attachments with unusually large or malformed embedded objects
Correlate Windows Error Reporting telemetry for WINWORD.EXE faults with subsequent process or network activity to identify exploit attempts

Monitoring Recommendations

Enable and forward Microsoft Defender Antivirus, AMSI, and Sysmon Event ID 1 and 3 to a centralized analytics platform for Office process behavior
Monitor SharePoint Server document upload activity and server-side rendering worker processes for crashes or unexpected code execution
Track patch compliance across all endpoints running Office and SharePoint to identify unremediated hosts

How to Mitigate CVE-2026-55055

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Update Guide for every affected Office and SharePoint build
Prioritize patching for users who routinely open documents from external senders and for internet-facing SharePoint servers
Verify that Microsoft 365 Apps clients are on a supported update channel and have received the current monthly security release

Patch Information

Microsoft has released fixes through its standard update channels for Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, Word 2016, Microsoft 365 for macOS, and supported SharePoint Server versions. Consult the Microsoft Security Update Guide entry for CVE-2026-55055 for build numbers and deployment instructions.

Workarounds

Enable Protected View and Office Application Guard so untrusted documents open in an isolated container that blocks arbitrary code execution
Configure Attack Surface Reduction rules to block Office applications from creating child processes and from injecting into other processes
Disable the Preview Pane in Outlook and Windows Explorer to prevent automatic rendering of untrusted Word files
Block or quarantine inbound .doc, .docm, and .rtf attachments at the mail gateway when business use cases permit

bash

# Example: enable ASR rules that block Office child process creation and Win32 API calls from Office macros
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A, `
  92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B `
  -AttackSurfaceReductionRules_Actions Enabled, Enabled