CVE-2026-55129: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55129 Overview

CVE-2026-55129 is a heap-based buffer overflow vulnerability in Microsoft Office that allows an unauthorized attacker to execute code locally. The flaw is classified under CWE-122 (Heap-based Buffer Overflow) and affects multiple Office versions across Windows and macOS platforms. Exploitation requires user interaction, typically by opening a specially crafted Office document. Successful exploitation can lead to arbitrary code execution in the context of the current user.

Critical Impact
An attacker who successfully exploits this vulnerability can execute arbitrary code with the privileges of the logged-on user, potentially leading to full compromise of the local system.

Affected Products

Microsoft 365 Apps (Enterprise, x64 and x86)
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows and macOS)
Microsoft 365 for macOS

Discovery Timeline

2026-07-14 - CVE-2026-55129 published to the National Vulnerability Database (NVD)
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55129

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in the document parsing routines of Microsoft Office. When Office processes a maliciously crafted file, it writes data beyond the bounds of an allocated heap buffer. This corruption of adjacent heap metadata or object pointers can be leveraged to hijack control flow. The resulting code execution runs with the privileges of the user opening the file, making standard user accounts a viable entry point for post-exploitation activity.

Root Cause

The root cause is improper validation of size or length values during the parsing of structured document content. When the parser copies attacker-controlled data into a fixed-size heap allocation, it fails to bound the write correctly. This aligns with CWE-122, where insufficient boundary checks on heap buffers allow adjacent memory to be overwritten.

Attack Vector

Exploitation is local and requires user interaction. An attacker crafts a malicious Office document and delivers it through email, a web download, or a shared drive. When the target opens the document in a vulnerable version of Word, Excel, PowerPoint, or another affected Office component, the parser triggers the overflow. No prior authentication to the target system is required, and the attacker gains code execution in the user's session. See the Microsoft Security Update CVE-2026-55129 advisory for vendor technical details.

Detection Methods for CVE-2026-55129

Indicators of Compromise

Unexpected child processes spawned from winword.exe, excel.exe, or powerpnt.exe, such as cmd.exe, powershell.exe, or rundll32.exe
Office applications crashing repeatedly when opening specific documents, indicating heap corruption attempts
Outbound network connections initiated by Office processes to unfamiliar external hosts shortly after document open
New files written to %APPDATA%, %TEMP%, or user startup folders by an Office process

Detection Strategies

Monitor process lineage where Office binaries are the parent of scripting or LOLBin processes
Alert on Office processes loading unsigned or unusual DLLs from user-writable directories
Correlate document open events with subsequent file, registry, and network activity within a short time window
Inspect inbound email attachments and downloaded files for known malicious Office document signatures

Monitoring Recommendations

Enable and forward Microsoft-Windows-Sysmon and Office telemetry to a centralized logging platform
Track application crash events (Event ID 1000) referencing Office executables for potential exploitation attempts
Monitor Attack Surface Reduction (ASR) rule audit logs for blocked Office child process creation

How to Mitigate CVE-2026-55129

Immediate Actions Required

Apply the security updates referenced in the Microsoft Security Update CVE-2026-55129 advisory to all affected Office installations
Inventory endpoints running Microsoft 365 Apps, Office 2016, 2019, 2021 LTSC, and 2024 LTSC on both Windows and macOS
Enable Protected View and Application Guard for Office to isolate documents from untrusted sources
Warn users to avoid opening unexpected Office attachments, particularly from external senders

Patch Information

Microsoft has released security updates that address this heap-based buffer overflow. Administrators should deploy the updates via Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or Microsoft AutoUpdate on macOS. Refer to the Microsoft Security Update CVE-2026-55129 advisory for build numbers and update packages specific to each Office channel.

Workarounds

Enforce Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes
Configure Group Policy to open documents from the internet or email in Protected View by default
Restrict macro execution from untrusted locations and block macros in files originating from the internet

bash

# Enable ASR rule: Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled