CVE-2026-55123: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55123 Overview

CVE-2026-55123 is a heap-based buffer overflow [CWE-122] in Microsoft Office PowerPoint that allows an unauthorized attacker to execute code locally. The flaw affects multiple Microsoft Office product lines, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and PowerPoint 2016 on both Windows (x86/x64) and macOS platforms. Exploitation requires user interaction, typically opening a crafted PowerPoint file, and grants the attacker code execution in the context of the current user.

Critical Impact
A crafted PowerPoint document can trigger heap corruption and execute arbitrary code with the privileges of the user opening the file, enabling initial access and follow-on compromise.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft PowerPoint 2016 (x64 and x86)

Discovery Timeline

2026-07-14 - CVE-2026-55123 published to the National Vulnerability Database (NVD)
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55123

Vulnerability Analysis

CVE-2026-55123 is a heap-based buffer overflow within Microsoft Office PowerPoint's document parsing logic. When PowerPoint processes a specially crafted presentation file, it writes data beyond the bounds of an allocated heap buffer. This corrupts adjacent heap metadata or object pointers, giving an attacker control over program flow. Successful exploitation results in arbitrary code execution in the context of the user who opened the document.

Because the attack vector is local and requires user interaction, delivery typically occurs through phishing emails, malicious file-sharing links, or drive-by download campaigns. Once the crafted .ppt, .pptx, or related Office file is opened, the vulnerable code path is triggered without further user action.

Root Cause

The root cause is improper bounds checking during the parsing of structured content inside a PowerPoint file. A malformed size or length field within the document causes the parser to allocate a heap buffer that is smaller than the data subsequently copied into it. This class of defect is tracked as CWE-122: Heap-based Buffer Overflow.

Attack Vector

The attacker crafts a malicious Office presentation file and delivers it to a target user through email attachments, cloud storage links, or web downloads. When the victim opens the file in a vulnerable Office client, PowerPoint parses the embedded structures and triggers the overflow. Code executes with the privileges of the logged-on user, which is sufficient to install malware, harvest credentials, or stage lateral movement. Microsoft's advisory for this issue is available in the Microsoft Security Update Guide.

No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication. The current EPSS probability is approximately 0.34%.

Detection Methods for CVE-2026-55123

Indicators of Compromise

PowerPoint or Office processes (POWERPNT.EXE, WINWORD.EXE) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
PowerPoint files delivered from external senders that trigger crashes, hangs, or Watson error reports referencing heap corruption
Unexpected network connections initiated by POWERPNT.EXE shortly after a document is opened
New persistence entries (Run keys, scheduled tasks, or startup folder items) created immediately after opening a .pptx or .ppt file

Detection Strategies

Alert on Office applications launching scripting engines or LOLBins, a common post-exploitation pattern for document-borne code execution
Correlate email delivery telemetry with subsequent PowerPoint file executions to identify weaponized attachments
Inspect PowerPoint files at the mail gateway for malformed OOXML structures and abnormally sized records
Monitor for crash dumps and Windows Error Reporting events tied to POWERPNT.EXE that indicate heap corruption

Monitoring Recommendations

Enable command-line and process-tree logging via Sysmon or an EDR agent to capture Office child-process relationships
Ingest endpoint, email, and identity telemetry into a central data lake to enable correlation across the attack chain
Track Office version inventory across the fleet to identify unpatched endpoints running vulnerable builds of Microsoft 365 Apps, Office 2019, 2021, or 2024

How to Mitigate CVE-2026-55123

Immediate Actions Required

Apply the security updates referenced in the Microsoft Security Update Guide for CVE-2026-55123 to all Windows and macOS endpoints running affected Office products
Prioritize patching for users who routinely receive external documents, including executives, finance, HR, and support staff
Verify that click-to-run updates for Microsoft 365 Apps are enabled and reporting successful installation
Block or quarantine inbound PowerPoint attachments from untrusted senders until patching completes

Patch Information

Microsoft has released security updates addressing CVE-2026-55123 across the affected product lines. Refer to the Microsoft Security Update Guide for the specific build numbers per channel (Current Channel, Monthly Enterprise Channel, Semi-Annual Enterprise Channel, and LTSC releases). Administrators should validate patch deployment by checking the installed Office version against the fixed builds listed in the advisory.

Workarounds

Configure Microsoft Office Protected View and Office File Block policy to open files from the internet and Outlook attachments in a sandboxed, read-only mode
Enable Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting into other processes
Use Group Policy to disable macros from untrusted locations and enforce Mark-of-the-Web (MOTW) handling on downloaded files
Restrict user accounts to standard privileges to limit the impact of code executed via a compromised Office session

bash

# Example: enable ASR rule blocking Office apps from creating child processes (PowerShell)
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Verify current ASR rule state
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids