CVE-2026-56195 Microsoft CVE debrief

Who should care

Users of Microsoft Office, particularly those using 365 Apps, Office 2016, Office 2019, Office 2021, and Office 2024, should be aware of this vulnerability and take necessary precautions to protect their systems. This includes applying patches provided by Microsoft and ensuring all users follow secure practices when using Microsoft Office.

Technical summary

The vulnerability is an out-of-bounds read issue in Microsoft Office, which could allow an unauthorized attacker to disclose information locally. The CVSS score is 5.5, and the severity is MEDIUM. The vulnerability affects various versions of Microsoft Office, including 365 Apps, Office 2016, Office 2019, Office 2021, and Office 2024. There is no information on known ransomware campaign use.

Defensive priority

Medium priority should be given to patching this vulnerability, as it could allow local information disclosure.

Recommended defensive actions

• Apply patches provided by Microsoft
• Ensure all users are aware of and follow secure practices when using Microsoft Office
• Monitor for any suspicious activity related to Microsoft Office
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-14T18:18:29.937Z and was last modified on 2026-07-16T13:40:15.753Z. The NVD entry is currently Analyzed. This vulnerability affects various versions of Microsoft Office, including 365 Apps, Office 2016, Office 2019, Office 2021, and Office 2024. The CVSS score is 5.5, and the severity is MEDIUM. There is no information on known ransomware campaign use. The CVE was published by CVE.org and detailed by NVD.

Official resources