CVE-2026-55134: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55134 Overview

CVE-2026-55134 is a stack-based buffer overflow [CWE-121] in Microsoft Office Word that enables local code execution. An attacker who successfully exploits the flaw runs arbitrary code in the context of the current user. Exploitation requires the target to open a specially crafted Word document, which makes weaponized attachments and drive-by download lures the most plausible delivery channels. The vulnerability affects multiple Office product lines including Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, Word 2016, and SharePoint Server. Microsoft published the advisory on July 14, 2026.

Critical Impact
Successful exploitation results in arbitrary code execution with the privileges of the logged-on user, enabling malware installation, credential theft, and lateral movement from the compromised endpoint.

Affected Products

Microsoft 365 Apps (Enterprise x64/x86) and Microsoft 365 for macOS
Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (Windows and macOS)
Microsoft Word 2016 and Microsoft SharePoint Server (2016, 2019, Subscription Edition)

Discovery Timeline

2026-07-14 - Microsoft releases security update for CVE-2026-55134
2026-07-14 - CVE-2026-55134 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55134

Vulnerability Analysis

The flaw is a stack-based buffer overflow in Microsoft Word's document parsing logic. When Word processes a malformed structure inside a crafted document, it writes past the bounds of a fixed-size stack buffer. The overflow corrupts adjacent stack data, including saved return addresses and structured exception handler records. Attackers use this corruption to redirect control flow into attacker-supplied shellcode or a return-oriented programming chain.

Exploitation is local and requires user interaction. The victim must open the malicious file, typically delivered through email attachments, phishing pages, or SharePoint document libraries. Because the vulnerable parser is shared across the Office suite, the same crafted content can affect Word, Microsoft 365 Apps, and SharePoint Server's document preview components.

Root Cause

The root cause is missing or insufficient bounds checking on attacker-controlled length values inside a Word file parser. The parser copies variable-length record data into a stack buffer without validating that the source length fits the destination, satisfying the conditions for [CWE-121] Stack-based Buffer Overflow.

Attack Vector

The attack vector is local with required user interaction. A remote attacker delivers a crafted .doc, .docx, .rtf, or related Office file. Opening the document in a vulnerable Word build triggers the overflow and executes code as the current user. On SharePoint Server, server-side processing of the same file format extends the impact surface to server accounts.

No public proof-of-concept exploit is available at publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-55134

Indicators of Compromise

Unexpected winword.exe child processes such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe spawned shortly after a document open event.
Office application crashes (WER events) referencing wwlib.dll or Word parsing modules immediately after opening an emailed attachment.
Outbound network connections initiated by winword.exe to previously unseen domains or IP addresses.
Creation of executables, scripts, or scheduled tasks under %APPDATA%, %TEMP%, or user Startup folders following document interaction.

Detection Strategies

Hunt for Office applications loading unusual DLLs or executing living-off-the-land binaries associated with post-exploitation activity.
Alert on Word or SharePoint worker processes exhibiting memory access violations paired with subsequent process creation events.
Inspect inbound email attachments for Office documents containing malformed or oversized record structures using content disarm and reconstruction tooling.

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office applications from creating child processes and injecting into other processes.
Forward Sysmon Event IDs 1 (process creation), 7 (image load), and 11 (file create) from user endpoints to a centralized SIEM for correlation.
Review SharePoint ULS logs and application event logs on document servers for parser exceptions or worker process restarts.

How to Mitigate CVE-2026-55134

Immediate Actions Required

Apply the July 2026 Microsoft security updates for all affected Office, Microsoft 365 Apps, Word, and SharePoint Server SKUs across Windows and macOS.
Prioritize patching internet-facing SharePoint Server deployments and endpoints belonging to high-value users such as executives and administrators.
Verify update deployment through Microsoft Endpoint Manager, WSUS, or the Microsoft 365 Apps admin center and confirm build numbers on managed devices.

Patch Information

Microsoft has issued fixed builds for all affected products. Refer to the Microsoft Security Update Guide for CVE-2026-55134 for the specific package identifiers and build numbers per SKU. SharePoint Server administrators must run the SharePoint Products Configuration Wizard after installing server-side updates.

Workarounds

Enable Protected View and Office Application Guard so untrusted documents open in an isolated container that limits filesystem and network access.
Configure the File Block policy via Group Policy to prevent Word from opening legacy binary formats received from the internet zone.
Block or quarantine inbound Office documents from external senders at the email gateway until patches are validated in production.

bash

# Example: enforce Protected View for files originating from the internet via Group Policy registry keys
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableAttachmentsInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableUnsafeLocationsInPV /t REG_DWORD /d 0 /f