CVE-2026-55127: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55127 Overview

CVE-2026-55127 is a heap-based buffer overflow [CWE-122] in Microsoft Office Word that allows an unauthorized attacker to execute code locally. The flaw affects a broad set of Microsoft productivity products, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, Word 2016, Office Online Server, and SharePoint Server. Exploitation requires user interaction, typically opening a crafted document. Successful exploitation results in arbitrary code execution in the context of the current user.

Critical Impact
An attacker who convinces a user to open a malicious Word document can execute code with the user's privileges, leading to full compromise of confidentiality, integrity, and availability on the affected system.

Affected Products

Microsoft 365 Apps (Enterprise x64/x86) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, Office 2024 LTSC (Windows and macOS), Microsoft Word 2016
Microsoft Office Online Server and SharePoint Server 2016/2019/Subscription Edition

Discovery Timeline

2026-07-14 - CVE-2026-55127 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55127

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Microsoft Office Word's document parsing logic. When Word processes a specially crafted file, it writes data beyond the bounds of an allocated heap buffer. This corruption can overwrite adjacent heap metadata or object pointers, enabling attacker-controlled execution flow. Because the affected parser is shared across the Office suite, the same defective code path is reachable through Word, Microsoft 365 Apps, and server components such as Office Online Server and SharePoint Server when they render documents.

Root Cause

The root cause is improper validation of size or length fields during heap allocation and copy operations in Word's document handling routines. A malformed record with inconsistent size metadata causes the parser to allocate a buffer smaller than the data subsequently written to it. This mismatch produces an out-of-bounds heap write classified as [CWE-122].

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted .doc, .docx, or .rtf file through email, chat, or a web download. When the victim opens the document or previews it in a vulnerable client, the malicious content triggers the overflow. Code executes with the privileges of the current user, providing a foothold for credential theft, lateral movement, or ransomware staging.

No public proof-of-concept or in-the-wild exploitation has been reported at time of publication. Refer to the Microsoft Security Update CVE-2026-55127 advisory for vendor technical details.

Detection Methods for CVE-2026-55127

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Word or Office processes crashing with heap corruption exceptions (c0000374, c0000005) shortly after opening a document.
Documents originating from external senders that trigger outbound network connections from Office processes immediately after being opened.

Detection Strategies

Hunt for Office processes writing executable content to %APPDATA%, %TEMP%, or startup folders.
Correlate document open events with subsequent process creation, DLL loads from user-writable paths, and abnormal parent-child process chains.
Inspect inbound email attachments and SharePoint uploads for malformed Office document structures using static parsers.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and injecting code.
Forward Sysmon process creation, image load, and file write events from endpoints running Office to a centralized SIEM for correlation.
Monitor SharePoint Server and Office Online Server logs for document conversion errors and worker process crashes that may indicate exploitation attempts.

How to Mitigate CVE-2026-55127

Immediate Actions Required

Apply the Microsoft security updates for all affected Office, Microsoft 365 Apps, Word 2016, Office Online Server, and SharePoint Server SKUs as listed in the MSRC advisory.
Prioritize patching internet-facing SharePoint Server and Office Online Server instances that automatically render user-supplied documents.
Advise users to avoid opening Office documents from untrusted sources until patches are deployed.

Patch Information

Microsoft has released security updates addressing CVE-2026-55127. Consult the Microsoft Security Update CVE-2026-55127 advisory for the specific KB articles and channel builds for each affected product, including Microsoft 365 Apps Current Channel, Semi-Annual Channel, Office 2019/2021/2024 LTSC, Word 2016, and SharePoint Server 2016/2019/Subscription Edition.

Workarounds

Enforce Protected View and Office File Block policies to prevent opening documents from the internet in editing mode.
Deploy Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and injecting into other processes.
Restrict document handling on SharePoint and Office Online Server to trusted content sources, and disable automatic previewing where feasible.

bash

# Configuration example: enable ASR rule blocking Office child process creation via PowerShell
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Enforce Protected View for files originating from the internet (registry)
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f