CVE-2026-55047 Microsoft CVE debrief

Who should care

Security teams and administrators responsible for Microsoft Office and SharePoint Server installations should be aware of this vulnerability. They should review and apply vendor patches for affected versions, conduct inventory checks to identify and update vulnerable systems, and monitor for potential exploitation attempts.

Technical summary

CVE-2026-55047 is an out-of-bounds read vulnerability in Microsoft Office that allows an unauthorized attacker to disclose information locally. The vulnerability has a CVSS score of 5.5 and a severity of MEDIUM. It affects various versions of Microsoft Office, including Office 2019, Office 2021, and Office 2024, as well as SharePoint Server. The vulnerability can be mitigated by applying vendor patches.

Defensive priority

Medium priority due to the local disclosure of information and the availability of vendor advisories. Implement compensating controls, such as network segmentation and access controls, for systems that cannot be patched immediately. Monitor relevant logs for signs of exploitation and review system configurations for potential vulnerabilities.

Recommended defensive actions

• Review and apply vendor patches for affected Microsoft Office and SharePoint Server versions.
• Conduct inventory checks to identify and update vulnerable systems.
• Monitor for potential exploitation attempts.
• Implement compensating controls, such as network segmentation and access controls.

Evidence notes

The CVE record and NVD details provide information on the vulnerability, its impact, and affected products. Vendor advisories are available for mitigation. The NVD entry is currently Analyzed. Evidence is limited to public sources and may not cover all affected deployments or specific exploitation details.

Official resources