CVE-2026-55132: Microsoft 365 Apps Use-After-Free Flaw

CVE-2026-55132 Overview

CVE-2026-55132 is a double free vulnerability [CWE-415] in Microsoft Office Word that allows an unauthorized attacker to execute arbitrary code locally. The flaw affects multiple Microsoft Office and Microsoft 365 product lines across Windows and macOS platforms, as well as SharePoint Server installations. Successful exploitation requires user interaction, typically by opening a crafted document. Code executes in the context of the current user, providing a foothold for further compromise.

Critical Impact
Attackers can achieve local code execution by convincing a user to open a malicious Word document, compromising confidentiality, integrity, and availability of the target system.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86)
Microsoft 365 for macOS, Microsoft Word 2016, Microsoft Office 2019, Office 2021 LTSC, and Office 2024 LTSC
Microsoft SharePoint Server 2016, 2019, and Subscription Edition

Discovery Timeline

2026-07-14 - CVE-2026-55132 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55132

Vulnerability Analysis

The vulnerability is a double free condition [CWE-415] within Microsoft Word document parsing routines. A double free occurs when a program calls the memory deallocation routine twice on the same memory address. This corrupts heap metadata used by the memory allocator to track free chunks. An attacker who controls the allocation state can convert the corruption into an arbitrary write primitive, leading to control of the instruction pointer.

Exploitation requires local access and user interaction. The victim must open a crafted document delivered through email, network share, or web download. Because the code runs in the user's security context, an attacker inherits the victim's file access, network reach, and application privileges. Chained with a local privilege escalation, the flaw enables full system compromise.

Root Cause

The root cause is duplicate release of a heap-allocated object during document processing. The Word rendering or parsing logic frees a structure along one code path and then frees the same pointer again along an error or cleanup path. The absence of a null assignment or ownership tracking between the two free operations allows the heap allocator to double-list the chunk in its free lists.

Attack Vector

The attack vector is local with required user interaction. Delivery occurs through phishing attachments, malicious SharePoint uploads, or drive-by document downloads. Preview handlers and automatic content loading can widen the exposure surface. No authentication is required on the target because execution occurs when the victim opens the file.

No public proof-of-concept exploit is available at time of writing. Refer to the Microsoft Security Update CVE-2026-55132 advisory for vendor technical detail.

Detection Methods for CVE-2026-55132

Indicators of Compromise

winword.exe spawning command interpreters such as cmd.exe, powershell.exe, or wscript.exe
Unexpected child processes writing executables or scripts to %APPDATA%, %TEMP%, or %PUBLIC% directories
Word crashes with heap corruption fault codes recorded in the Windows Application event log
Outbound network connections initiated directly by winword.exe to untrusted hosts

Detection Strategies

Hunt for Office applications loading unsigned or unusual DLLs from user-writable paths
Alert on Office documents originating from Mark-of-the-Web sources that trigger process creation events
Correlate SharePoint document upload telemetry with subsequent endpoint execution anomalies on downloading hosts

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office child process creation and log to a central SIEM
Ingest Sysmon Event IDs 1, 7, and 11 from workstations running Office to identify anomalous module loads and file writes
Monitor Windows Error Reporting telemetry for repeated winword.exe faults that may indicate exploitation attempts

How to Mitigate CVE-2026-55132

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-55132 to all affected Office and SharePoint installations
Prioritize patching for users who routinely open documents from external senders and for internet-facing SharePoint servers
Verify Microsoft 365 Apps update channels are current on both Windows and macOS endpoints

Patch Information

Microsoft has published updates for Microsoft 365 Apps, Microsoft 365 for macOS, Office 2019, Office 2021 LTSC, Office 2024 LTSC, Word 2016, and SharePoint Server 2016, 2019, and Subscription Edition. Consult the vendor advisory for build numbers and KB identifiers applicable to each channel.

Workarounds

Enable Protected View and Office Application Guard for documents originating from the internet and email attachments
Block or restrict macros and active content from files carrying the Mark-of-the-Web attribute through Group Policy
Deploy Attack Surface Reduction rules that prevent Office applications from creating child processes and injecting into other processes

bash

# Configuration example: enable ASR rule blocking Office child process creation
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled