CVE-2026-55130: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55130 Overview

CVE-2026-55130 is a heap-based buffer overflow vulnerability in Microsoft Office Word that enables local code execution. An attacker can craft a malicious Word document that, when opened by a user, triggers memory corruption on the heap and executes arbitrary code in the context of the current user. The flaw affects multiple Microsoft Office product lines, including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, SharePoint Server, and Word 2016. Exploitation requires user interaction, typically opening a weaponized document delivered through phishing or shared file channels.

Critical Impact
Successful exploitation grants arbitrary code execution under the logged-on user's privileges, enabling full compromise of confidentiality, integrity, and availability on the affected host.

Affected Products

Microsoft 365 Apps (x86 and x64, Enterprise)
Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC
Microsoft Word 2016 and Microsoft SharePoint Server (Subscription, 2016 Enterprise, 2019)

Discovery Timeline

2026-07-14 - CVE-2026-55130 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-55130

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow classified under [CWE-122] and [CWE-787] (out-of-bounds write). Microsoft Word improperly validates the size of data written to a heap-allocated buffer while parsing a specific document structure. When the parser processes attacker-controlled length or offset fields, it writes past the end of the allocated region, corrupting adjacent heap metadata or object pointers.

Because the corruption occurs during document parsing, the attacker controls both the trigger and the overflow contents. This lets a skilled adversary shape the heap, overwrite virtual function pointers or object headers, and pivot control flow into shellcode or a ROP chain. Code execution runs with the privileges of the user opening the file, providing a foothold for further post-exploitation actions such as credential theft, lateral movement, or ransomware staging.

Root Cause

The root cause is missing or incorrect bounds checking in a Word document parser routine that copies attacker-controlled data into a fixed or undersized heap buffer. The parser trusts a length or index value embedded in the file rather than validating it against the actual buffer size, allowing an out-of-bounds write on the process heap.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted .doc, .docx, .rtf, or related Office file via email attachment, web download, collaboration platform, or SharePoint share. When the victim opens the document in a vulnerable Office application, the parsing routine triggers the heap overflow and executes attacker-supplied code. Preview handlers and SharePoint document rendering paths may also expose the vulnerable code without an explicit open action.

No public proof-of-concept exploit is currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-55130

Indicators of Compromise

Office application processes (winword.exe, wwlib.dll host) spawning unexpected child processes such as cmd.exe, powershell.exe, mshta.exe, rundll32.exe, or wscript.exe.
Unexpected outbound network connections initiated by winword.exe shortly after a document is opened.
Crash dumps or Windows Error Reporting entries referencing heap corruption in Word parsing modules.
Newly written executables, DLLs, or scheduled tasks created by an Office process in user-writable directories such as %APPDATA% or %TEMP%.

Detection Strategies

Hunt for process ancestry where Office binaries are the parent of interpreters or LOLBins, correlated with recent document opens.
Monitor for suspicious in-memory allocations, RWX regions, or thread injections originating from Word.
Inspect inbound email attachments and SharePoint uploads for Office files containing anomalous embedded objects or malformed structures using sandbox detonation.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction (ASR) rules that block Office child process creation and executable content from email.
Forward Sysmon events (Process Create, Image Load, Network Connect) and Office telemetry to your SIEM for correlation across users and hosts.
Alert on document-open events that correlate with new persistence artifacts (Run keys, scheduled tasks, or startup folder entries) within a short time window.

How to Mitigate CVE-2026-55130

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-55130 advisory to all affected Office and SharePoint installations.
Prioritize patching of endpoints belonging to high-risk users such as executives, finance, HR, and IT administrators who frequently open external documents.
Block or quarantine inbound Office documents from untrusted senders at the mail gateway until patch coverage is verified.

Patch Information

Microsoft has published fixes through the standard Microsoft Update channels. Refer to the Microsoft Security Update CVE-2026-55130 advisory for the specific update packages and build numbers per product family. Microsoft 365 Apps receive the fix through the Current, Monthly Enterprise, and Semi-Annual Enterprise channels, while Office 2019, 2021 LTSC, 2024 LTSC, Word 2016, and SharePoint Server require their respective Public Update packages.

Workarounds

Configure Office to open documents from the internet in Protected View and enforce Block macros from the internet via Group Policy.
Disable the Windows Explorer and Outlook preview pane for Office file types to prevent parsing without explicit user action.
Restrict opening of Office files to signed or trusted sources by enabling File Block policies for legacy formats such as .doc and .rtf.

bash

# Example Group Policy registry keys to enforce Protected View and block legacy Word formats
# Enable Protected View for files originating from the internet
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f

# Block opening of legacy .doc and .rtf files in Word
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\FileBlock" /v Word2003Files /t REG_DWORD /d 2 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\FileBlock" /v RtfFiles /t REG_DWORD /d 2 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\FileBlock" /v OpenInProtectedView /t REG_DWORD /d 0 /f