CVE-2026-55027 Microsoft CVE debrief

Who should care

Users of Microsoft Office, particularly those using 365 Apps, Office 2016, Office 2019, Office 2021, Office 2024, and SharePoint Server, should be aware of this vulnerability and take necessary actions to mitigate it. This includes reviewing their deployments, applying patches provided by Microsoft, and implementing compensating controls.

Technical summary

The vulnerability is an out-of-bounds read issue in Microsoft Office, which could allow an unauthorized attacker to disclose information locally. The CVSS score is 5.5, and the severity is MEDIUM. The vulnerability affects various versions of Microsoft Office, including 365 Apps, Office 2016, Office 2019, Office 2021, Office 2024, and SharePoint Server. Users of Microsoft Office should be aware of this vulnerability and take necessary actions to mitigate it.

Defensive priority

Medium priority should be given to patching this vulnerability, as it could allow local information disclosure.

Recommended defensive actions

• Apply patches provided by Microsoft
• Inventory and update vulnerable Microsoft Office installations
• Monitor for suspicious activity related to Microsoft Office
• Implement compensating controls, such as limiting access to sensitive information
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, its severity, and affected products. Microsoft has provided a patch for this vulnerability. The vulnerability is an out-of-bounds read issue in Microsoft Office, which could allow an unauthorized attacker to disclose information locally. The CVSS score is 5.5, and the severity is MEDIUM.

Official resources