CVE-2026-55140 Details

A heap-based buffer overflow vulnerability has been identified in Microsoft Office. This vulnerability allows an unauthorized attacker to execute code locally. It affects multiple versions of Microsoft Office, including Office 2016, Office 2019, Office 365, and various LTSC versions for both Mac and Windows. The vulnerability requires user interaction, as an attacker must send a malicious Office file and convince the user to open it. Additionally, the Preview Pane can be used to exploit this vulnerability.

Users can download the security update for their specific version of Microsoft Office. For Microsoft Office 2016 and 2019, security updates are available through the Microsoft Update Catalog. For Microsoft 365 Apps for Enterprise, security updates can be downloaded via the Office Update mechanism. Mac users can download the security update from the Microsoft Update page for Mac.