CVE-2026-55140 – Microsoft Office Remote Code Execution Vulnerability

A heap-based buffer overflow vulnerability in Microsoft Office allows an unauthorized attacker to execute arbitrary code on a local system. Successful exploitation requires a user to open a specially crafted Office document, and Microsoft confirms that the Preview Pane is also an attack vector. Security updates have been released for affected Microsoft Office products across Windows and macOS.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability affects Microsoft Office by allowing arbitrary code execution through a specially crafted Office document. An attacker can distribute the malicious file through email, collaboration platforms, or file-sharing services and persuade a user to open or preview it. Successful exploitation allows code execution with the privileges of the current user, potentially enabling malware installation, credential theft, or further compromise of the affected system.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Microsoft Office. A specially crafted Office document can trigger memory corruption, resulting in arbitrary code execution. Although the vulnerability is categorized as Remote Code Execution, Microsoft explains that the attack itself is carried out locally after user interaction. Microsoft also confirms that the Preview Pane is an attack vector. Where multiple update packages are available for affected products, Microsoft recommends installing all applicable updates, which may be applied in any order.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Exploitation requires no attacker privileges but does require user interaction, specifically opening or previewing a specially crafted Office document.

BUSINESS IMPACT:
Microsoft Office is one of the most frequently targeted applications in phishing and document-based attacks. Successful exploitation could allow attackers to execute malicious code, deploy ransomware, steal confidential information, or establish a foothold for additional attacks within the enterprise. Organizations that regularly exchange Office documents with external parties face increased exposure.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing all applicable security updates for affected Microsoft Office products.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical. Although user interaction is required, Office documents remain one of the most common delivery methods for malware and phishing campaigns. Prompt deployment of all applicable security updates significantly reduces the risk of compromise.