CVE-2026-55055 Microsoft CVE debrief

Who should care

Users of Microsoft Office Word, particularly those using versions 2016, 2019, 2021, and 2024, as well as Microsoft 365 Apps, should be aware of this vulnerability and apply patches or mitigations as available.

Technical summary

The vulnerability is a stack-based buffer overflow in Microsoft Office Word, which could allow an unauthorized attacker to execute code locally. The CVSS score is 7.8 with a severity of HIGH. The vulnerability affects multiple versions of Microsoft Office, including Office 2016, 2019, 2021, 2024, and Microsoft 365 Apps.

Defensive priority

High priority should be given to patching or mitigating this vulnerability, especially in environments where Microsoft Office Word is widely used.

Recommended defensive actions

• Apply patches or updates provided by Microsoft for the affected versions of Microsoft Office Word and Microsoft 365 Apps.
• Implement compensating controls such as restricting access to sensitive areas of the network.
• Monitor for suspicious activity related to Microsoft Office Word.
• Conduct regular inventory checks to ensure all instances of Microsoft Office Word are patched or mitigated.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, its impact, and affected products. Microsoft has provided a vendor advisory and patch for this vulnerability.

Official resources