CVE-2026-55132 Microsoft CVE debrief

Who should care

Users of Microsoft Office Word, particularly those using Microsoft 365 Apps, Office 2019, Office 2021, and Office 2024, should be aware of this vulnerability and apply patches or mitigations as recommended by Microsoft.

Technical summary

The vulnerability is caused by a double free issue in Microsoft Office Word, which allows an unauthorized attacker to execute code locally. The vulnerability has a CVSS score of 7.8 and is classified as HIGH severity. The affected products include Microsoft 365 Apps, Office 2019, Office 2021, Office 2024, and SharePoint Server.

Defensive priority

High priority should be given to patching or mitigating this vulnerability, especially for organizations using affected versions of Microsoft Office Word.

Recommended defensive actions

• Apply patches or updates provided by Microsoft to vulnerable versions of Microsoft Office Word
• Use compensating controls such as monitoring and exception tracking to detect potential exploitation attempts
• Inventory checks to identify and prioritize patching of vulnerable systems
• Consider implementing additional security measures such as restricting access to sensitive areas of the network

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, but indicate that it is a high-severity issue that requires attention. Further investigation and testing may be necessary to fully understand the impact of this vulnerability.

Official resources