CVE-2026-55139 Overview
CVE-2026-55139 is an out-of-bounds read vulnerability [CWE-125] in Microsoft Office that enables local information disclosure. An unauthorized attacker can trigger the flaw when a user opens a maliciously crafted Office document. The vulnerability spans multiple Office product lines, including Microsoft 365 Apps, Microsoft Office 2016, 2019, 2021, and 2024, on both Windows and macOS platforms. Exploitation requires user interaction but no privileges on the target system. Microsoft published the advisory on July 14, 2026, and rated the issue as low severity based on limited confidentiality impact and no integrity or availability effect.
Critical Impact
Successful exploitation discloses portions of Office process memory to an attacker, potentially revealing sensitive document contents or memory addresses useful for chaining with other vulnerabilities.
Affected Products
- Microsoft 365 Apps (Enterprise, x64 and x86)
- Microsoft Office 2016, 2019, 2021, and 2024 (x64 and x86)
- Microsoft 365 and Office 2021/2024 LTSC for macOS
Discovery Timeline
- 2026-07-14 - CVE-2026-55139 published to the National Vulnerability Database (NVD)
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-55139
Vulnerability Analysis
The vulnerability is classified as an out-of-bounds read [CWE-125] within Microsoft Office. When Office parses a crafted file, code reads memory beyond the intended buffer boundary. The read data can then be returned to attacker-controlled contexts, disclosing information from the Office process address space.
The confidentiality impact is limited to data accessible to the current Office process. The flaw does not permit modification of data or disruption of service. Attackers frequently combine such reads with memory corruption bugs to bypass Address Space Layout Randomization (ASLR) or extract sensitive document content.
Root Cause
Out-of-bounds reads in Office parsers typically stem from missing bounds validation when handling structured file formats such as OOXML, RTF, or legacy binary formats. A length field, offset, or index derived from the input file is trusted without verification against the actual allocated buffer size. When the parser dereferences the resulting pointer, it accesses memory outside the intended region.
Attack Vector
The attack requires local access and user interaction. A user must open a malicious Office document delivered through email, a file share, a web download, or a removable medium. No authentication or elevated privileges are required on the target host. Because the impact is limited to information disclosure, the flaw is more useful as a component of a multi-stage exploit chain than as a standalone attack.
No public proof-of-concept, exploit code, or evidence of exploitation in the wild has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
See the Microsoft CVE-2026-55139 Advisory for vendor-supplied technical details.
Detection Methods for CVE-2026-55139
Indicators of Compromise
- Office documents (.docx, .xlsx, .pptx, .rtf, .doc, .xls) received from untrusted senders and opened by end users
- Anomalous Office application crashes or Windows Error Reporting (WER) events referencing winword.exe, excel.exe, or powerpnt.exe
- Office processes spawning unexpected child processes shortly after document open
Detection Strategies
- Inspect email gateways and web proxies for Office attachments with malformed structural elements or unusual embedded objects
- Correlate Office process crashes with recent file open events to identify potential exploitation attempts
- Enable Microsoft Defender Application Guard for Office to isolate untrusted document rendering
Monitoring Recommendations
- Monitor endpoint telemetry for Office parent processes performing outbound network connections after opening documents
- Ingest Office telemetry and WER data into a centralized logging platform to detect crash patterns across the fleet
- Track file provenance using Mark-of-the-Web (MOTW) attributes to flag documents originating from the internet
How to Mitigate CVE-2026-55139
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-55139 across all affected Office installations
- Enforce Protected View for documents originating from the internet, email attachments, and unsafe locations
- Educate users to avoid opening unexpected Office attachments, particularly from unknown senders
Patch Information
Microsoft has issued security updates for all supported Office channels, including Microsoft 365 Apps, Office 2016, 2019, 2021, and 2024 on Windows, and Microsoft 365 and Office 2021/2024 LTSC on macOS. Administrators should deploy the corresponding update through Microsoft Update, Windows Server Update Services (WSUS), Microsoft Intune, or the Microsoft AutoUpdate (MAU) tool on macOS. Verify the installed build number against the version listed in the MSRC advisory.
Workarounds
- Block or quarantine Office attachments at the email gateway when patching is delayed
- Configure Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and injecting into other processes
- Restrict document opening to Protected View for all files sourced from external locations via Group Policy
# Enforce Protected View for internet-sourced Office documents via Group Policy registry keys
reg add "HKCU\Software\Microsoft\Office\16.0\Word\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security\ProtectedView" /v DisableInternetFilesInPV /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
