CVE-2026-55045 Microsoft CVE debrief

Who should care

Users of Microsoft Office, particularly those using 365 Apps, Office 2016, Office 2019, Office 2021, Office 2024, and SharePoint Server, should be aware of this vulnerability and take necessary precautions to mitigate its impact. This includes applying patches, updating affected installations, and implementing compensating controls.

Technical summary

The vulnerability is an out-of-bounds read issue in Microsoft Office, which could allow an unauthorized attacker to execute code locally. The CVSS score is 8.4, indicating a high severity. The vulnerability affects various versions of Microsoft Office, including 365 Apps, Office 2016, Office 2019, Office 2021, Office 2024, and SharePoint Server. Users should prioritize patching to mitigate this vulnerability.

Defensive priority

High priority should be given to patching this vulnerability, as it allows for local code execution and affects various versions of Microsoft Office.

Recommended defensive actions

• Apply patches provided by Microsoft
• Inventory and update affected Microsoft Office installations
• Implement compensating controls, such as monitoring for suspicious activity
• Consider disabling or restricting access to affected systems until patched
• Review and verify affected system configurations

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected products. Microsoft has provided a vendor advisory and patch for this vulnerability. The vulnerability allows for local code execution, making it a high-priority issue for users of affected Microsoft Office versions. Evidence is limited to CVE and NVD entries; further verification is recommended.

Official resources