CVE-2026-55121: Microsoft 365 Apps Info Disclosure Flaw

CVE-2026-55121 Overview

CVE-2026-55121 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office that allows a local attacker to disclose sensitive information. Exploitation requires user interaction, typically by opening a specially crafted document. The flaw affects multiple supported Office releases including Microsoft 365 Apps, Office 2016, 2019, 2021, 2024, and SharePoint Server. Microsoft published the advisory on July 14, 2026, and last updated it on July 15, 2026.

Critical Impact
A successful exploit permits an unauthorized attacker to read memory contents outside intended buffer boundaries, potentially exposing sensitive data processed by Office applications on the affected host.

Affected Products

Microsoft 365 Apps (Enterprise x64/x86) and Microsoft 365 for macOS
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows and macOS)
Microsoft SharePoint Server 2016, 2019, and Subscription Edition

Discovery Timeline

2026-07-14 - CVE-2026-55121 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-55121

Vulnerability Analysis

The vulnerability is an out-of-bounds read condition classified under [CWE-125]. Microsoft Office parses a wide range of complex file formats, and this flaw occurs when the application reads memory past the intended boundary of an allocated buffer during document processing. The result is unintended disclosure of process memory contents, which can include cached document data, pointers, or other sensitive artifacts loaded into the Office process address space.

The issue is local in nature and requires the victim to open a crafted file. It does not grant code execution or write access to memory. Confidentiality impact is rated none in the CVSS vector, but availability impact is high, indicating the read can also destabilize the Office process. The EPSS probability sits at roughly 0.353%, reflecting a low near-term likelihood of observed exploitation.

Root Cause

The root cause is missing or insufficient bounds validation in an Office file-format parser. When the parser processes a malformed structure, it reads beyond the end of an allocated buffer. Microsoft has not publicly disclosed the specific parsing routine affected.

Attack Vector

Exploitation requires local access and user interaction. An attacker delivers a crafted Office document, typically via phishing email, a compromised file share, or a malicious download link. When the victim opens the file in a vulnerable Office application, the parser triggers the out-of-bounds read. The attacker cannot exploit the flaw remotely without user interaction.

No verified public proof-of-concept code is available. Refer to the Microsoft Security Update Guide for technical details.

Detection Methods for CVE-2026-55121

Indicators of Compromise

Unexpected Microsoft Office application crashes (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) with access violation exceptions in Windows Event Log entries from Application Error (Event ID 1000).
Office documents originating from untrusted email attachments, external file shares, or web downloads that trigger parser errors on open.
Suspicious child processes spawned by Office applications following the opening of a crafted document.

Detection Strategies

Monitor Windows Error Reporting telemetry for repeated faulting modules within Office binaries, which can indicate exploitation attempts.
Inspect email gateways for attachments with anomalous Office file structures or malformed OLE, OOXML, or RTF headers.
Correlate document open events with subsequent process instability or unusual memory access patterns using EDR telemetry.

Monitoring Recommendations

Enable and forward Microsoft Office telemetry and Windows Defender ASR (Attack Surface Reduction) event logs to a central SIEM.
Track file provenance using Mark-of-the-Web (MOTW) tagging to identify documents from untrusted zones opened outside Protected View.
Alert on any Office process crash paired with subsequent script interpreter or shell activity on the same host.

How to Mitigate CVE-2026-55121

Immediate Actions Required

Apply the security updates referenced in the Microsoft Security Update Guide for CVE-2026-55121 across all affected Office and SharePoint Server installations.
Ensure Microsoft 365 Apps clients are on a supported update channel and have received the latest monthly security build.
Verify Protected View and Office File Block policies remain enabled for documents originating from the internet or untrusted locations.

Patch Information

Microsoft has released updates addressing CVE-2026-55121 for all affected products. Administrators should deploy updates through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Configuration Manager, or the Microsoft 365 Apps admin center. SharePoint Server administrators must apply the corresponding server-side security updates and follow post-installation configuration steps documented by Microsoft.

Workarounds

Enforce Protected View for files originating from the internet, unsafe locations, and Outlook attachments through Group Policy or Microsoft Intune.
Configure Office File Block settings to prevent opening of legacy or unnecessary file formats where feasible.
Restrict opening of Office documents from unknown senders through email filtering, attachment sandboxing, and user awareness training.

bash

# Example Group Policy registry keys to enforce Protected View in Word
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f