CVE-2026-55018 Details

A use-after-free vulnerability has been identified in Microsoft Office, which could allow an unauthorized attacker to execute code locally. This vulnerability requires user interaction, as an attacker must send a malicious Office file and convince the user to open it. The Preview Pane can also be used to trigger this vulnerability.

Users can download the security update for this vulnerability through the Microsoft Update Catalog. For Microsoft Office 2016, the security update is available via the Microsoft Update Catalog or can be downloaded directly from the Microsoft Download Center. Instructions for updating Microsoft 365 Apps for Enterprise are also available on the Microsoft Office Update page.