PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55045 Microsoft CVE debrief

CVE-2026-55045 is an out-of-bounds read vulnerability in Microsoft Office, allowing unauthorized attackers to execute code locally. This vulnerability affects various versions of Microsoft Office, including 365 Apps, Office 2016, Office 2019, Office 2021, Office 2024, and SharePoint Server. Users should be aware of this high-severity vulnerability, which has a CVSS score of 8.4. The CVE record was published on 2026-07-14T18:18:16.193Z and has not been modified since then. The NVD entry is currently Analyzed. To address this vulnerability, users should prioritize patching and consider implementing compensating controls.

Vendor
Microsoft
Product
Microsoft 365 Apps for Enterprise
CVSS
HIGH 8.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-14
Original CVE updated
2026-07-16
Advisory published
2026-07-14
Advisory updated
2026-07-16

Who should care

Users of Microsoft Office, particularly those using 365 Apps, Office 2016, Office 2019, Office 2021, Office 2024, and SharePoint Server, should be aware of this vulnerability and take necessary precautions to mitigate its impact. This includes applying patches, updating affected installations, and implementing compensating controls.

Technical summary

The vulnerability is an out-of-bounds read issue in Microsoft Office, which could allow an unauthorized attacker to execute code locally. The CVSS score is 8.4, indicating a high severity. The vulnerability affects various versions of Microsoft Office, including 365 Apps, Office 2016, Office 2019, Office 2021, Office 2024, and SharePoint Server. Users should prioritize patching to mitigate this vulnerability.

Defensive priority

High priority should be given to patching this vulnerability, as it allows for local code execution and affects various versions of Microsoft Office.

Recommended defensive actions

  • Apply patches provided by Microsoft
  • Inventory and update affected Microsoft Office installations
  • Implement compensating controls, such as monitoring for suspicious activity
  • Consider disabling or restricting access to affected systems until patched
  • Review and verify affected system configurations

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected products. Microsoft has provided a vendor advisory and patch for this vulnerability. The vulnerability allows for local code execution, making it a high-priority issue for users of affected Microsoft Office versions. Evidence is limited to CVE and NVD entries; further verification is recommended.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-55045 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-55045

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-55045 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-55045

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.