CVE-2026-55125: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55125 Overview

CVE-2026-55125 is a heap-based buffer overflow vulnerability in Microsoft Office that allows an unauthorized attacker to execute code locally. The flaw affects multiple Office releases, including Microsoft 365 Apps, Office 2016 through 2024, and SharePoint Server. Exploitation requires user interaction, typically opening a specially crafted document. Successful exploitation compromises the confidentiality, integrity, and availability of the affected system. The weakness is tracked under CWE-122: Heap-based Buffer Overflow.

Critical Impact
An attacker who convinces a user to open a malicious Office document can execute arbitrary code in the context of the current user, enabling malware installation, data theft, and lateral movement.

Affected Products

Microsoft 365 Apps (x64 and x86, Enterprise)
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows and macOS)
Microsoft SharePoint Server 2016, 2019, and Subscription Edition

Discovery Timeline

2026-07-14 - CVE-2026-55125 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55125

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Microsoft Office document parsing routines. When Office processes a malformed structure inside a document, it writes beyond the bounds of an allocated heap buffer. This corruption can overwrite adjacent heap metadata or function pointers used by the Office process. An attacker who controls the overflowed data can steer execution into attacker-supplied shellcode or a return-oriented programming (ROP) chain. Code executes in the security context of the user opening the file. The same code path is present in Office desktop clients and in server-side rendering components used by SharePoint Server.

Root Cause

The root cause is insufficient validation of size or length fields in document content before copying data into a fixed-size heap allocation. Because the vulnerable allocation lives on the heap, corruption can affect neighboring objects and function tables. Microsoft has classified the issue under CWE-122.

Attack Vector

The attack vector is local and requires user interaction. A common delivery pattern is a phishing email carrying a weaponized Office document, or a link to a document hosted on a file share or SharePoint site. Once the user opens the file, parsing triggers the overflow and yields code execution without additional privileges. The Preview Pane may also serve as an exposure surface for certain Office file types. For server components, an attacker able to upload a crafted document to SharePoint may trigger the flaw when the document is rendered.

No verified public proof-of-concept code is available. See the Microsoft Security Response Center advisory for technical details.

Detection Methods for CVE-2026-55125

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, or OUTLOOK.EXE, such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Crash events or Windows Error Reporting entries referencing Office processes with heap corruption exception codes (0xC0000374, 0xC0000005).
Office processes writing executable files to %APPDATA%, %TEMP%, or %PUBLIC% and then executing them.
Outbound network connections initiated directly by Office processes to previously unseen domains or IP addresses.

Detection Strategies

Hunt for anomalous process lineages where an Office application is the parent of a scripting or living-off-the-land binary.
Alert on Office processes loading unsigned DLLs from user-writable directories.
Correlate email attachment delivery with subsequent Office document opens and abnormal process activity on the same host.

Monitoring Recommendations

Enable Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and injecting into other processes.
Forward Sysmon process, image load, and network events to a centralized SIEM for correlation.
Monitor SharePoint document upload activity for anomalous file types and sizes, and review server-side rendering logs for exceptions.

How to Mitigate CVE-2026-55125

Immediate Actions Required

Apply Microsoft's security updates for all affected Office and SharePoint Server versions listed in the MSRC advisory.
Prioritize patching endpoints frequently exposed to external documents, including executive assistants, finance, HR, and helpdesk workstations.
Verify Click-to-Run and Microsoft 365 Apps update channels are configured to install security updates automatically.
Enable Protected View and Office File Block policies for documents originating from the internet.

Patch Information

Microsoft has released updates addressing CVE-2026-55125 across Microsoft 365 Apps, Office 2016, 2019, 2021 LTSC, 2024 LTSC (Windows and macOS), and SharePoint Server 2016, 2019, and Subscription Edition. Refer to the Microsoft CVE-2026-55125 Update for the KB numbers and build versions that correspond to each product.

Workarounds

Enforce Protected View for files from the internet, unsafe locations, and Outlook attachments through Group Policy.
Enable Microsoft Defender ASR rules D4F940AB-401B-4EFC-AADC-AD5F3C50688A (block Office child processes) and 3B576869-A4EC-4529-8536-B80A7769E899 (block Office from creating executable content).
Restrict macro execution using the "Block macros from running in Office files from the Internet" policy.
On SharePoint Server, restrict document upload permissions and disable server-side rendering of untrusted content where feasible.

bash

# Enable ASR rules blocking Office child processes and executable content creation
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
Add-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 -AttackSurfaceReductionRules_Actions Enabled

# Enforce Protected View for files originating from the internet
Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Office\16.0\Word\Security\ProtectedView' -Name 'DisableInternetFilesInPV' -Value 0