CVE-2026-55045

This is a security bug in Microsoft Office that can be turned into a way for an attacker to run code on a computer. Think of it like Office has a “reading past the end” mistake; a malicious person can use that mistake to make the computer do something harmful. If your business runs a vulnerable Office or SharePoint server version, updating is the key protection.

This matters to you if your organization uses Microsoft Office (including Microsoft 365 Apps) or runs Microsoft SharePoint Server 2016/2019/Subscription Edition. The vulnerability requires that a vulnerable Office version is installed, and it does not require a user to click or provide a login.

Reachability is not fully clear from the available information, so treat any machine/server running a vulnerable version as potentially at risk—especially where an attacker could get local access to that device or environment.

This is marked RED because it allows arbitrary code execution on a local system when a vulnerable Microsoft Office/SharePoint component is installed, and it requires neither authentication nor user interaction. Even though no clear public, dated exploitation report or public exploit code was found, you should prioritize patching because the impact (code execution and possible takeover) is high. Update affected systems immediately per the fixed versions listed.

1. Inventory what’s installed

• Identify endpoints running: Microsoft 365 Apps, Microsoft Office, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024.
• Identify servers running: Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition.

2. Confirm whether you’re on a vulnerable version

• For Microsoft Office (Windows), check for 16.0.5561.1000. If your version is older than the listed fixed version, you should patch.
• For Microsoft Office for Mac / LTSC for Mac, check for 16.111.26071215.
• For SharePoint Enterprise Server 2016, check for 16.0.5561.1001.
• For SharePoint Server 2019, check for 16.0.10417.20175.
• For SharePoint Server Subscription Edition, check for 16.0.19725.20434.

3. Patch to the fixed versions

• Microsoft 365 Apps: update to the latest Office build available from https://aka.ms/OfficeSecurityReleases.
• Microsoft Office (Windows): upgrade to 16.0.5561.1000.
• Microsoft Office for Mac / LTSC for Mac (2021, 2024): upgrade to 16.111.26071215.
• SharePoint Server versions: apply updates so the server is at the fixed versions listed above.

4. If patching is delayed (temporary mitigation)

• Reduce the chance an attacker can reach the local system where Office/SharePoint is installed (for example, limit who can access the machine, tighten physical access, and restrict untrusted accounts/services).
• Apply compensating controls consistent with your environment’s normal hardening (network access restrictions, least privilege), while you schedule the fixed-version upgrades.

5. After updating

• Confirm the new Office/SharePoint version is actually running.
• Monitor for unusual local activity around the Office/SharePoint servers (for example, unexpected processes or service changes), and ensure your normal incident response steps are ready.

CISA due date: Not provided (this CVE is not listed in the CISA KEV catalog based on the findings).

CVE-2026-55045 is a Microsoft Office vulnerability involving an out-of-bounds read (CWE-125) that can allow an unauthorized attacker to execute arbitrary code locally. The findings indicate: authentication is not required and there is no user interaction required; however, exploitation depends on having a vulnerable Microsoft Office installed. KEV does not list this CVE, and no public exploit code was found; news reporting did not provide a clear dated exploitation claim, so exploitation in the wild is not confirmed by the findings. The risk remains high due to the code-execution impact and the straightforward precondition (presence of a vulnerable version).