CVE-2026-55128: Microsoft 365 Apps Use-After-Free Flaw

CVE-2026-55128 Overview

CVE-2026-55128 is a use-after-free vulnerability [CWE-416] in Microsoft Office Word that allows an unauthorized attacker to execute code locally. The flaw affects multiple Microsoft Office and SharePoint products, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, Word 2016, Office Online Server, and SharePoint Server. Exploitation requires user interaction, typically by opening a specially crafted Word document. Successful exploitation grants the attacker the ability to execute arbitrary code in the context of the current user.

Critical Impact
An attacker who convinces a user to open a malicious Word document can execute arbitrary code with the privileges of the user, potentially leading to full compromise of the endpoint.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86) and Microsoft 365 for macOS
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC (Windows and macOS)
Microsoft Word 2016, Office Online Server, and SharePoint Server 2016/2019/Subscription Edition

Discovery Timeline

2026-07-14 - CVE-2026-55128 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55128

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in Microsoft Office Word's document parsing logic. Use-after-free flaws occur when a program continues to reference memory after it has been freed, allowing attackers to influence what data occupies the reclaimed memory region. In Word, this typically arises during processing of complex document structures such as embedded objects, revision tracking data, or malformed OLE streams.

An attacker crafts a document that triggers premature deallocation of an internal object, then forces Word to reuse the dangling pointer. By controlling the contents of the freed memory, the attacker can hijack control flow and execute arbitrary code within the Word process. The impact extends to SharePoint Server and Office Online Server because these components use the same Word rendering engine to preview or convert documents server-side.

Root Cause

The root cause is improper object lifetime management within Word's document handler. A code path releases a heap object while another reference to that object remains active. When the stale reference is later dereferenced, the attacker-controlled contents of the reallocated buffer are treated as a valid object, enabling virtual function pointer hijacking or arbitrary write primitives.

Attack Vector

Exploitation is local and requires user interaction. The typical attack chain involves delivering a weaponized .doc, .docx, or .rtf file through phishing email, malicious download, or a SharePoint document library. Opening or previewing the file in a vulnerable version of Word triggers the use-after-free. On server-side products such as SharePoint Server and Office Online Server, document conversion or preview operations may reach the vulnerable code path without direct user interaction on that host.

No verified public proof-of-concept exploit is available at this time. Refer to the Microsoft Vulnerability Advisory CVE-2026-55128 for authoritative technical details.

Detection Methods for CVE-2026-55128

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Crash dumps or Windows Error Reporting entries referencing WINWORD.EXE with access violation exceptions in heap operations.
Word documents delivered via email or SharePoint that contain unusual embedded objects, malformed OLE streams, or heavy JavaScript/ActiveX content.
Outbound network connections initiated by WINWORD.EXE to previously unseen domains or IP addresses shortly after document open events.

Detection Strategies

Monitor process lineage where Office applications spawn scripting hosts or LOLBins, a common post-exploitation behavior for Office-based code execution.
Deploy YARA rules against inbound Word documents to identify malformed OLE structures and known exploitation primitives targeting use-after-free conditions.
Correlate Office application crashes with subsequent suspicious activity such as new persistence entries, credential access, or lateral movement attempts.

Monitoring Recommendations

Ingest Sysmon Event IDs 1 (Process Create), 7 (Image Load), and 11 (File Create) filtered on Office processes into your SIEM for baseline analysis.
Enable audit logging in SharePoint Server and Office Online Server to track document conversion and preview operations that involve untrusted uploads.
Alert on any child process of WINWORD.EXE outside of a curated allowlist, and on writes by Word to autorun locations such as Startup folders or Run registry keys.

How to Mitigate CVE-2026-55128

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Vulnerability Advisory CVE-2026-55128 to all affected endpoints and servers.
Prioritize patching of internet-facing SharePoint Server and Office Online Server instances, which process untrusted documents at scale.
Enforce Protected View and Application Guard for Office to contain execution of documents originating from the internet or email attachments.

Patch Information

Microsoft has released security updates addressing CVE-2026-55128 across Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, Word 2016, SharePoint Server 2016/2019/Subscription Edition, and Office Online Server. Consult the Microsoft Vulnerability Advisory CVE-2026-55128 for the exact KB numbers and package versions applicable to each product.

Workarounds

Block or quarantine Office documents from external senders at the email gateway until patches are deployed across the estate.
Configure Microsoft Office Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and from injecting code into other processes.
Disable preview handlers for Word documents in Windows Explorer and Outlook to reduce automatic parsing of untrusted files.

bash

# Enable ASR rules that block Office child processes and code injection
Set-MpPreference -AttackSurfaceReductionRules_Ids `
  D4F940AB-401B-4EFC-AADC-AD5F3C50688A,`
  75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions Enabled, Enabled