CVE-2026-55134 Microsoft CVE debrief

Who should care

Users of Microsoft Office Word, particularly those using versions 2016, 2019, 2021, and 2024, as well as SharePoint Server 2016, 2019, and Subscription Edition, should be aware of this vulnerability and take necessary precautions. This includes reviewing their deployments, applying patches or updates, and monitoring systems for suspicious activity.

Technical summary

The vulnerability is a stack-based buffer overflow in Microsoft Office Word, which could allow an attacker to execute code locally. The CVSS score is 7.8 with a severity of HIGH. The vulnerability affects various versions of Microsoft Office, including Word 2016, 2019, 2021, and 2024, as well as SharePoint Server 2016, 2019, and Subscription Edition. A patch is available from Microsoft.

Defensive priority

High

Recommended defensive actions

• Apply patches or updates provided by Microsoft to vulnerable systems
• Use compensating controls such as firewalls and intrusion detection systems
• Monitor systems for suspicious activity
• Use secure coding practices when developing applications
• Limit user privileges to minimize the impact of a successful attack

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, its severity, and affected products. Microsoft has provided a patch and vendor advisory for this vulnerability. The vulnerability has a CVSS score of 7.8 with a severity of HIGH. Evidence is limited to CVE and NVD details. Defenders should verify patch deployment and monitor for suspicious activity.

Official resources