CVE-2026-55056: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55056 Overview

CVE-2026-55056 is a heap-based buffer overflow vulnerability in Microsoft Office that allows an unauthorized attacker to execute arbitrary code locally. The flaw affects multiple supported Office versions across Windows and macOS platforms, including Microsoft 365 Apps, Office 2016, 2019, 2021, and 2024. Exploitation requires user interaction, typically through opening a crafted Office document. Successful exploitation compromises confidentiality, integrity, and availability at the level of the current user. The vulnerability is tracked under [CWE-122] Heap-based Buffer Overflow and [CWE-787] Out-of-bounds Write.

Critical Impact
A crafted Office document can trigger heap corruption in the parser and execute attacker-controlled code with the privileges of the user opening the file.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2016, 2019, 2021, and 2024 (Windows x64/x86 and macOS LTSC editions)

Discovery Timeline

2026-07-14 - CVE-2026-55056 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55056

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in a Microsoft Office file parsing component. Office allocates a heap buffer sized based on attacker-controlled metadata within a document, then writes data past the allocated boundary. This out-of-bounds write corrupts adjacent heap structures and can be shaped to overwrite function pointers or object vtables. An attacker who controls the resulting control flow gains code execution in the Office process context.

Because exploitation occurs entirely within the local Office process, the attacker does not need prior authentication to the target system. The attack vector is local and requires the victim to open a malicious file delivered through email, a shared link, or removable media.

Root Cause

The root cause is missing or insufficient bounds validation when copying document-supplied data into a heap-allocated buffer. The parser trusts length or count fields from the file structure without validating them against the allocated buffer size, which is characteristic of [CWE-122] and [CWE-787] weaknesses. Malformed record headers, embedded objects, or structured storage streams within Office file formats can trigger the condition.

Attack Vector

Exploitation follows a client-side social engineering pattern. An attacker crafts a malicious Office document (Word, Excel, PowerPoint, or a compound OLE container) containing the trigger payload and delivers it to the victim. When the user opens the document, Office parses the malformed structure, overflows the heap buffer, and executes attacker-supplied shellcode or ROP chains. Preview panes and Protected View bypasses can increase reliability. See the Microsoft Security Update CVE-2026-55056 for vendor technical details.

Detection Methods for CVE-2026-55056

Indicators of Compromise

Unexpected child processes spawned by winword.exe, excel.exe, powerpnt.exe, or outlook.exe, especially cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Office processes making outbound network connections to untrusted hosts shortly after a document is opened.
Crash events or Windows Error Reporting entries referencing heap corruption in Office binaries.
Newly written executables, DLLs, or scripts in %APPDATA%, %TEMP%, or user Startup folders following document activity.

Detection Strategies

Hunt for parent-child process anomalies where Office applications spawn scripting or LOLBins.
Inspect inbound email and file-sharing traffic for Office documents with malformed OLE, RTF, or OOXML structures.
Correlate document open events with subsequent process injection, credential access, or persistence behaviors.

Monitoring Recommendations

Enable and forward Microsoft Defender AV, Sysmon (Event IDs 1, 7, 11), and Office telemetry to a centralized log platform.
Monitor for exploitation-adjacent techniques mapped to MITRE ATT&CK T1203 (Exploitation for Client Execution) and T1204.002 (User Execution: Malicious File).
Alert on Protected View exits and Mark-of-the-Web removal on Office documents.

How to Mitigate CVE-2026-55056

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-55056 advisory to all affected Office installations.
Verify Microsoft 365 Apps update channel status and force an update where clients are behind.
Prioritize patching for users who handle externally sourced documents, including finance, HR, and executive support staff.

Patch Information

Microsoft has issued fixes through the standard Office update channels for Microsoft 365 Apps, Office LTSC 2021, Office LTSC 2024, Office 2019, Office 2016, and the macOS editions of Microsoft 365 and Office LTSC. Refer to the Microsoft Security Update CVE-2026-55056 advisory for build numbers and deployment guidance.

Workarounds

Enforce Protected View and Application Guard for Office for documents originating from the internet or email attachments.
Block or quarantine Office file types at the email gateway when senders are external and unauthenticated.
Enable Attack Surface Reduction rules that block Office applications from creating child processes and from injecting code into other processes.
Restrict macro execution and disable legacy file format support (for example, older .doc, .xls, and RTF) where business needs allow.

bash

# Example: Enable ASR rule blocking Office child process creation (PowerShell)
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled