CVE-2026-55142 Overview
CVE-2026-55142 is a numeric truncation error [CWE-197] in Microsoft Office Word that allows an unauthorized attacker to disclose sensitive information locally. The flaw affects multiple Microsoft Office and Microsoft 365 product lines, including SharePoint Server. Exploitation requires user interaction, typically by opening a crafted document. Successful exploitation leaks confidential memory contents to the attacker without impacting integrity or availability.
Critical Impact
A local attacker who convinces a user to open a malicious Word document can read confidential in-process memory, potentially exposing credentials, document contents, or other sensitive data handled by Office.
Affected Products
- Microsoft 365 Apps (Enterprise, x86 and x64) and Microsoft 365 for macOS
- Microsoft Office 2019, Office LTSC 2021, and Office LTSC 2024 (x86 and x64)
- Microsoft Word 2016 and Microsoft SharePoint Server 2016, 2019, and Subscription Edition
Discovery Timeline
- 2026-07-14 - CVE-2026-55142 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-55142
Vulnerability Analysis
The vulnerability is a numeric truncation error in Microsoft Office Word's document parsing logic. Word converts a larger numeric type into a smaller one during size or offset calculations, losing high-order bits in the process. The truncated value is then used to bound a memory read, causing the code to read outside the intended buffer. The attacker receives the extra bytes as part of rendered document data, disclosing adjacent process memory.
Because the attack vector is local and requires the victim to open a crafted document, exploitation typically relies on phishing or file-sharing lures. Confidentiality impact is high, while integrity and availability are unaffected. SharePoint Server is affected because it uses the same Word rendering components server-side to process uploaded documents.
Root Cause
The root cause is improper handling of numeric type conversions in Word's file parsing code, categorized as CWE-197 Numeric Truncation Error. A value that exceeds the destination type's range is silently narrowed, producing an incorrect length or offset that fails subsequent bounds checks based on the truncated value.
Attack Vector
An attacker crafts a Word document containing malformed structures that trigger the truncation during parsing. The victim opens the document in an affected version of Word, Microsoft 365 Apps, or a Word component invoked by SharePoint. Word returns or renders memory beyond the intended buffer, which the attacker retrieves by inspecting document output or through embedded fields.
No verified proof-of-concept code is publicly available for this issue. Refer to the Microsoft CVE-2026-55142 Advisory for vendor-authored technical details.
Detection Methods for CVE-2026-55142
Indicators of Compromise
- Inbound emails or shared links delivering .doc, .docx, .rtf, or .docm files from untrusted senders, particularly with unusual structure or oversized embedded objects.
- Word or winword.exe processes crashing or generating Watson error reports shortly after opening a document.
- SharePoint document conversion or preview services logging parser exceptions when handling specific uploaded files.
Detection Strategies
- Inspect Office documents at the mail gateway using sandbox detonation to observe abnormal memory access patterns in Word.
- Correlate document-open events in endpoint telemetry with subsequent outbound network activity from winword.exe, which may indicate exfiltration of leaked data.
- Hunt for anomalous child processes or script hosts spawned by Word after opening documents received from external sources.
Monitoring Recommendations
- Enable Microsoft Defender Attack Surface Reduction rules that block Office child process creation and Win32 API calls from macros.
- Forward Office telemetry, Windows Application event logs, and SharePoint ULS logs to a centralized SIEM for correlation.
- Monitor SharePoint file upload activity and document preview generation for repeated parser failures against the same file.
How to Mitigate CVE-2026-55142
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-55142 Advisory to all affected Office, Microsoft 365 Apps, and SharePoint Server instances.
- Prioritize patching endpoints belonging to users who routinely receive documents from external senders.
- Confirm that Microsoft 365 Apps update channels are current and that macOS Office deployments have received the corresponding update.
Patch Information
Microsoft has released fixes through its standard update channels. Consult the Microsoft CVE-2026-55142 Advisory for build numbers per product and channel, and validate installation with winword.exe version checks after deployment.
Workarounds
- Enforce Protected View for documents originating from the internet and other untrusted locations.
- Block or quarantine Office documents from external senders at the mail gateway pending patch deployment.
- Restrict SharePoint server-side document preview and conversion for untrusted content until affected servers are patched.
# Verify installed Microsoft 365 Apps version on Windows
reg query "HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /v VersionToReport
# Force Microsoft 365 Apps to check for and install updates
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
