CVE-2026-55140: Microsoft 365 Apps Buffer Overflow Flaw

CVE-2026-55140 Overview

CVE-2026-55140 is a heap-based buffer overflow vulnerability in Microsoft Office that enables local code execution. The flaw is categorized under [CWE-122] and affects the full supported range of Microsoft Office and Microsoft 365 Apps deployments on Windows and macOS. Successful exploitation allows an unauthorized attacker to run arbitrary code in the context of the current user by convincing that user to open a crafted document.

Critical Impact
Attackers who trick a user into opening a malicious Office file can execute code locally with the victim's privileges, compromising confidentiality, integrity, and availability.

Affected Products

Microsoft 365 Apps (Enterprise x64 and x86)
Microsoft 365 for macOS
Microsoft Office 2016, 2019, 2021 LTSC, and 2024 LTSC (Windows x64/x86 and macOS where applicable)

Discovery Timeline

2026-07-14 - CVE-2026-55140 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-55140

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Microsoft Office document parsing routines. When Office processes a crafted file, it writes data past the bounds of an allocated heap buffer. This corrupts adjacent heap memory, including object metadata and function pointers used by the application.

An attacker who controls the overflow can steer program execution into attacker-supplied code or reuse existing gadgets to bypass mitigations. Because the exploit runs inside the Office process, the resulting code executes with the user's privileges. The CVSS vector indicates local attack complexity with required user interaction, consistent with a file-open exploitation flow.

Root Cause

The root cause is improper validation of size or length values during parsing of structured content in an Office document. A field derived from the untrusted file is used to size or index a heap buffer without adequate bounds checking. The resulting out-of-bounds write on the heap satisfies the conditions of [CWE-122].

Attack Vector

Exploitation requires the victim to open a malicious document delivered via email, shared storage, or a web download. No prior authentication to the target system is required by the attacker, but user interaction is mandatory. The Preview Pane may also serve as a rendering surface, depending on file type and Office configuration. Refer to the Microsoft CVE-2026-55140 Advisory for authoritative technical details.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at the time of publication.

Detection Methods for CVE-2026-55140

Indicators of Compromise

Unexpected child processes spawned by WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, or OUTLOOK.EXE, such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe.
Office processes writing executables, scripts, or DLLs into user-writable paths like %APPDATA%, %TEMP%, or %PUBLIC%.
Crashes of Office applications with Windows Error Reporting entries referencing heap corruption immediately after opening a document.

Detection Strategies

Hunt for process-lineage anomalies where Office binaries invoke script interpreters, LOLBins, or network utilities.
Inspect inbound email attachments and shared documents for malformed Office file structures using sandbox detonation.
Correlate Office application crash events (Event ID 1000) with subsequent suspicious process creation or outbound network activity.

Monitoring Recommendations

Enable and forward Sysmon Event IDs 1, 7, and 11 for Office processes to a central analytics platform.
Monitor Microsoft Defender Application Guard and Attack Surface Reduction (ASR) telemetry for blocks originating from Office child-process rules.
Alert on unsigned or newly observed modules loaded into Office processes shortly after document open.

How to Mitigate CVE-2026-55140

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-55140 Advisory across all Office and Microsoft 365 Apps installations.
Verify Click-to-Run and macOS Office channels are pulling the July 2026 update train.
Prioritize patching endpoints used by high-value users such as executives, finance, and IT administrators.

Patch Information

Microsoft has released fixes through its standard update channels for Microsoft 365 Apps, Office 2016, 2019, 2021 LTSC, and 2024 LTSC on both Windows and macOS. Consult the vendor advisory for build numbers and KB identifiers specific to each channel.

Workarounds

Enable Protected View and Office Application Guard so untrusted documents open in an isolated container.
Configure Attack Surface Reduction rules that block Office applications from creating child processes and from injecting code into other processes.
Restrict opening of documents from the internet using the Mark-of-the-Web and block macro-enabled files sourced externally via Group Policy.

bash

# Enable ASR rule: Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
                 -AttackSurfaceReductionRules_Actions Enabled

# Block Office from injecting code into other processes
Set-MpPreference -AttackSurfaceReductionRules_Ids 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
                 -AttackSurfaceReductionRules_Actions Enabled