CVE-2026-55033

Think of this as a “booby-trapped document” problem: a malicious file can take advantage of a weakness in Microsoft Word’s handling of certain content. If someone opens that file, it can cause Word to run code it shouldn’t. In practice, that can lead to malware being installed or your business being compromised through a simple document download.

This matters if your business runs affected Microsoft products, especially Microsoft Word within Microsoft 365 Apps / Microsoft Office, and also affected SharePoint Server versions. It is not about login credentials; it centers on what happens when a user opens a crafted document (so the risk depends on whether an attacker can get a user to open the file). Treat it as a risk if the vulnerable apps are reachable via normal user activity (email attachments, downloaded documents, or links) and users can be induced to open untrusted files.

This is a RED issue because it’s a remote code execution vulnerability in Microsoft Word with very serious impact (code running in the context of the user). Even though there is no clear, dated public exploitation report in the provided findings and no public exploit code, the combination of “user opens the document” and the wide use of Office/Word means you should prioritize patching immediately.

1. Confirm exposure (what you have):

   • Identify which of these you run: Microsoft 365 Apps / Microsoft Office / Microsoft 365; Microsoft Word 2016; Microsoft Office 365 for Mac; Microsoft Office LTSC for Mac 2021; Microsoft Office LTSC for Mac 2024; Microsoft SharePoint Enterprise Server 2016; Microsoft SharePoint Server 2019; Microsoft SharePoint Server Subscription Edition.
   • Record your current versions/build numbers.

2. Compare to fixed versions (what to install):

   • Microsoft 365 Apps / Microsoft Office: install the update(s) provided in the Microsoft Office security release guide for CVE-2026-55033: https://aka.ms/OfficeSecurityReleases (also mirrored at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55033).
   • Microsoft Office 365 for Mac / Office LTSC for Mac 2021 / Office LTSC for Mac 2024: update to version 16.111.26071215.
   • Microsoft SharePoint Enterprise Server 2016: update to 16.0.5561.1001.
   • Microsoft SharePoint Server 2019: update to 16.0.10417.20175.
   • Microsoft SharePoint Server Subscription Edition: update to 16.0.19725.20434.
   • Microsoft Word 2016: update to 16.0.5561.1000.

3. Upgrade / maintenance window plan:

   • Schedule the updates promptly for all systems where the affected Office/Word or SharePoint Server versions are installed.
   • After updating, re-check the build/version to ensure it matches a fixed version listed above.

4. If patching is delayed (workaround while you wait):

   • Reduce the chance of a user opening an untrusted document: tighten email filtering, block/limit macros and unknown document sources where your policy allows it, and instruct users not to open unexpected Office attachments.
   • In high-risk teams (e.g., those receiving lots of external email), temporarily restrict opening files from untrusted senders until the update is complete.

5. Monitor after updates:

   • Review email/document gateway logs for suspicious messages and check endpoint security events for Office/Word launched from unusual locations.
   • Keep an eye on Microsoft’s update guide page for follow-on revisions related to this CVE.

CISA due date: Not provided in the findings (KEV entry not listed).

Severity is high (CVSS 7.8) and the weakness is associated with integer overflow/wraparound (CWE-122, CWE-190). The likely trigger mechanism is a crafted Microsoft Word document that causes unsafe behavior during parsing/processing, which can lead to unauthorized code execution (remote code execution in the Word/Office context) when the document is opened.

Findings context:

• No KEV listing in CISA’s KEV catalog (not listed).
• No public exploit code on record.
• Exploitation is not clearly claimed with a dated report in the provided news findings.
• EPSS is listed as 0.5% with a flat trend, but this is only predictive and is not the basis for the urgency.

Attack vector notes from provided CVSS guidance: no special privileges required (PR:N) but user interaction is involved (UI:R), meaning the attacker’s path typically includes getting a user to open a malicious document.