CVE-2026-55132

This is a flaw in Microsoft Word that can “break” how data is handled when a specially crafted document is opened. If an attacker manages to get you to open that document, the bug can let them run malicious code on the computer you’re using. It’s like a booby-trapped invoice file—opening it can hand control of your device to the attacker, under your user account.

This matters if your business uses Microsoft Word or Microsoft Office/Microsoft 365 apps, including the listed macOS Office versions, Microsoft Word 2016, and the listed Microsoft SharePoint Server editions. The core issue does not require an attacker to have a login, but it does require that a user opens a crafted document. The risk is therefore tied to whether your environment allows untrusted Word files to be opened (for example via email, downloads, or shared files).

This is RED because attackers only need to get a victim to open a malicious Word document to trigger local code execution, and Microsoft has provided fixed versions for multiple Office and SharePoint products. While the findings provided do not confirm active exploitation in the news, the impact is high and the patch is available now. Treat this as an urgent update to reduce the chance of a successful document-based attack against your endpoints.

1. Identify installed products and versions

   • On user endpoints, check the installed Microsoft Office/Microsoft 365 apps and specifically note whether you have Microsoft Word 2016, Microsoft 365 apps, or the listed macOS Office builds.
   • On SharePoint servers (on-prem), record the SharePoint edition and build/version.

2. Determine whether you’re on a vulnerable version

   • macOS (Office 365 for Mac / Office LTSC for Mac 2021 and 2024): vulnerable if you are below 16.111.26071215; the fix is 16.111.26071215.
   • SharePoint Server (on-prem): vulnerable if below the fixed builds listed in the patch section.
   • Windows Microsoft 365 apps and Microsoft Office: use the security release feed at https://aka.ms/OfficeSecurityReleases to move to the patched security update for your channel.

3. Upgrade to the fixed releases

   • Apply the Microsoft Office/Office 365 updates for your environment.
   • For macOS, update to at least 16.111.26071215.
   • For SharePoint, upgrade to at least:
     • 16.0.5561.1001 (SharePoint Enterprise Server 2016)
     • 16.0.10417.20175 (SharePoint Server 2019)
     • 16.0.19725.20434 (SharePoint Server Subscription Edition)

4. If patching is delayed (temporary risk reduction)

   • Tighten email and file controls to reduce the chance employees open untrusted Word attachments.
   • Add extra handling for unexpected documents (e.g., quarantine unknown attachments, require confirmation before opening shared files).
   • Remove any document that users opened which triggered security alerts or suspicious behavior.

5. What to monitor after patching

   • Look for unusual application behavior on endpoints around the time of any suspicious document opening (unexpected processes, repeated prompts, or sudden crashes).
   • Review email/file gateway logs for Word attachment deliveries to your users.

6. Exploitation reporting status and timeline

   • The provided findings do not include a KEV listing and do not cite named, dated exploitation incidents for this specific CVE. The safest approach is to update immediately using the fixed versions listed by Microsoft.

CVE-2026-55132 is a Microsoft Word remote code execution issue categorized under CWE-415, described as a double-free vulnerability. The mechanism is triggered locally when a user opens a specially crafted document, and it can allow arbitrary code execution in the context of the current user. The findings indicate no CISA KEV listing and no publicly recorded exploit code, and they do not provide clear evidence of active exploitation in the supplied news material. The patch is available across multiple Microsoft Office/Microsoft 365 app and SharePoint Server product lines; fixed versions are specified for macOS Office and several SharePoint Server editions, while Windows Office/Microsoft 365 apps are addressed via Microsoft’s Office security release updates.