CVE-2026-55124: Microsoft 365 Apps Information Disclosure

CVE-2026-55124 Overview

CVE-2026-55124 is an information disclosure vulnerability in Microsoft Office Word caused by improper validation of a specified input type [CWE-20]. An attacker can craft a malicious document that, when opened by a local user, discloses sensitive information from the Word process context. Exploitation requires user interaction but no prior authentication. The flaw affects a broad range of Microsoft Office products including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, Office Online Server, SharePoint Server, and Word 2016. Microsoft has published an advisory tracking the issue and released updates through the standard servicing channels.

Critical Impact
A local attacker leveraging a crafted Word document can disclose confidential in-process memory or file content, enabling reconnaissance and follow-on attacks against Microsoft Office users.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Office Online Server, SharePoint Server (Subscription, 2016 Enterprise, 2019), and Word 2016

Discovery Timeline

2026-07-14 - CVE-2026-55124 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55124

Vulnerability Analysis

The vulnerability resides in the Word document parsing path. Microsoft Word fails to properly validate a specified input type when processing document structures. When a crafted file is opened, the parser reads or interprets data outside its intended type contract. The result is exposure of memory or file content that the user opening the document should not see.

Exploitation is local and requires the target to open a malicious document. Attackers typically deliver the file through phishing, shared drives, or SharePoint document libraries. The scope of disclosure is limited to the confidentiality of data accessible to the Word process on the victim system.

Root Cause

The root cause is improper input validation [CWE-20]. Word does not enforce type constraints on a particular field during document parsing. This lets the parser act on attacker-controlled values as if they were trusted, returning content from unintended memory or file regions to the document rendering pipeline.

Attack Vector

The attack vector is local and requires user interaction. An adversary crafts a Word document containing malformed structures that trigger the parsing flaw. The victim opens the file in an affected version of Word, Microsoft 365 Apps, or through server-side rendering such as Office Online Server or SharePoint Server. Once opened, the vulnerable parser leaks in-process data. Disclosed information may include memory fragments, file path metadata, or content from other documents recently handled by the process.

No public proof-of-concept or in-the-wild exploitation has been reported for CVE-2026-55124. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-55124

Indicators of Compromise

Unexpected Word documents (.doc, .docx, .rtf) arriving through email or shared storage from untrusted senders.
winword.exe opening documents from temporary directories, browser download folders, or Outlook attachment cache followed by anomalous file reads.
SharePoint Server or Office Online Server rendering user-supplied documents with subsequent unusual memory access patterns.

Detection Strategies

Inspect inbound email attachments and file uploads with static analyzers that flag malformed Office Open XML structures.
Correlate winword.exe process telemetry with reads of unrelated user files or credential stores immediately after document open.
On SharePoint and Office Online Server, monitor document conversion workers for unusual crash, restart, or memory-region access events.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office child process creation and content extraction anomalies.
Forward Office telemetry, Windows Security, and Sysmon events to a centralized SIEM for correlation across users and hosts.
Track document-open events combined with outbound network activity to identify staged exfiltration of disclosed content.

How to Mitigate CVE-2026-55124

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-55124 Advisory to all affected Office and SharePoint installations.
Prioritize patching for internet-exposed Office Online Server and SharePoint Server instances that render user-supplied documents.
Reinforce user awareness on opening unexpected Word documents from external senders.

Patch Information

Microsoft has released security updates for Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021 LTSC, Office 2024 LTSC, Office Online Server, SharePoint Server (Subscription, 2016, 2019), and Word 2016. Refer to the Microsoft CVE-2026-55124 Advisory for build numbers and deployment guidance across each channel.

Workarounds

Open documents from untrusted sources in Protected View and keep Office Protected View policies enforced through Group Policy.
Block or quarantine Word documents at the email gateway when they originate from external senders and contain macros or embedded objects.
Restrict document rendering on SharePoint and Office Online Server to authenticated internal users until patches are deployed.

bash

# Enforce Protected View for documents from the internet, unsafe locations, and Outlook attachments
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f