CVE-2026-55018

Microsoft Office Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 38th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile38th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which Microsoft Office product and version your devices run (Windows: Microsoft 365 Apps/Microsoft Office; macOS: Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024).
If you have Microsoft Office (Windows), update to version 16.0.5561.1000 or later.
If you have Microsoft 365 Apps (Windows), update using Microsoft’s Office security releases guidance at https://aka.ms/OfficeSecurityReleases until your build is on the fixed line.
If you use Microsoft Office 365 for Mac or either LTSC for Mac (2021/2024), update all affected Macs to 16.111.26071215.
After updating, be extra cautious with email attachments and downloaded Office documents until users confirm they’re on the fixed versions.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

This is a Microsoft Office bug that could let someone run malicious code on your computer if you open a specially made Office file; if you handle emails or downloads, you should update promptly.

A use-after-free in Microsoft Office can lead to local arbitrary code execution when a user opens a crafted malicious Office document; it requires no login, but does require user interaction (opening the file).

If you're affected

Malware runs as your user
Data theft from Office files
Ransomware or full compromise risk
Work disruption from device takeover

What is it

Think of this as a “memory handling” mistake in Microsoft Office. If an employee opens a specially crafted Office document, the document can potentially trick Office into running attacker code on that same computer—like installing a program through the file, not through a website login.

Who is affected

This matters if you run Microsoft Office products on Windows or macOS—specifically Microsoft 365 Apps, Microsoft Office, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. The protection gap is triggered when a user opens a malicious Office file, so it’s most relevant to businesses where staff receive external emails or download documents. This is only a risk if an attacker can get a user to open a crafted file in Office.

How urgent is it

This is a high-impact Office flaw that can allow attackers to run code on the machine after a user opens a malicious document. Treat it as urgent because Office is commonly used across small businesses and the path to trigger it is a normal workflow (opening an attachment).

What to do — in detail

Inventory affected apps and versions
- On Windows devices:
  - Identify whether the machine runs Microsoft 365 Apps or Microsoft Office.
  - Record the Office version (the fixed version for Microsoft Office is 16.0.5561.1000).
- On macOS devices:
  - Identify whether the machine runs Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, or Microsoft Office LTSC for Mac 2024.
  - Record the Office version; fixed is 16.111.26071215.
Confirm exposure (quick checks)
- If your Microsoft Office version is older than the fixed version(s) listed below, you are exposed to this vulnerability in the code path used by Office.
- If you cannot quickly determine the build, plan to update immediately and then re-check the version post-update.
Upgrade to fixed versions
- Microsoft Office (Windows): upgrade to 16.0.5561.1000 or later.
- Microsoft 365 Apps (Windows): update using Microsoft’s Office security releases process at https://aka.ms/OfficeSecurityReleases until you’re on the fixed build included there.
- Microsoft Office 365 for Mac / Office LTSC for Mac 2021 / Office LTSC for Mac 2024: upgrade all Macs to 16.111.26071215.
Temporary workaround if patching is delayed
- Reduce risk by restricting who can open externally provided Office documents (especially from unexpected senders).
- Apply stricter attachment handling for email:
  - Don’t open attachments from unknown/unverified senders.
  - Treat unexpected “invoice,” “resume,” or “document” attachments as suspicious until validated.
- Where feasible, open documents in a controlled workflow (e.g., dedicated testing machine) for high-risk sources.
After updating: what to monitor
- Watch for unusual behavior around document opening (unexpected prompts, new processes spawned by Office, or sudden application crashes followed by suspicious activity).
- If you have endpoint logging, review events around the time Office documents were opened by users.
Exploitation status note
- No CISA KEV listing and no clear dated press claim or public exploit code were provided in the findings, so active exploitation timing is not confirmed here; however, the vulnerability is still serious because the trigger is a common action (opening a file).

Technical context

CVE-2026-55018 is a Microsoft Office remote code execution vulnerability driven by a use-after-free condition (CWE-416). The mechanism described in the findings is that an attacker can cause arbitrary code to execute locally when a user opens a specially crafted Office file; there is no required authentication, but user interaction (opening the file) is required. The findings do not list it as KEV and do not provide evidence of incidents or public exploit code, but the impact is high because successful execution occurs with the privileges of the user running Office. The patch guidance provided includes fixed versions for Microsoft Office (16.0.5561.1000), Microsoft Office 365 for Mac and both Mac LTSC lines (16.111.26071215), and Microsoft 365 Apps via Microsoft’s Office security releases portal (https://aka.ms/OfficeSecurityReleases).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS38th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 38th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 2 days, from the signal feeds we watch.

2026-07-16OpenVAS check addedpatch available, record updated
2026-07-15Record updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US
- Microsoft 365 Apps for EnterpriseDesktop AppConsumer Software / productivity
- microsoft 365SaaS ServiceSaaSCloud & SaaS / saas-application
- office 2016Desktop AppOn-premConsumer Software / productivity
- office 2019Desktop AppOn-premConsumer Software / productivity
- office 2021Desktop AppOn-premConsumer Software / productivity
- office 2024Desktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC 2021Desktop AppConsumer Software / productivity
- Microsoft Office 365 for MacDesktop AppOn-premConsumer Software / productivity

And 6 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable