CVE-2026-55134
Status: AnalyzedHigh (7.8)—
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Base score: 7.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.57%
- Percentile among all scored CVEs: 45
- Score date: 10/4/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
🎯 ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1203Exploitation for Client Executionexecution95 % - Primary impact
T1059Command and Scripting Interpreterexecution90 %
Buffer overflow en Word con UI:R (abrir fichero preparado) y ejecución de código local, típico de T1203. El desbordamiento permite ejecución arbitraria de comandos (T1059).
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
🛡️ ATT&CK mitigations that cover these techniques
Affected technologies (7)
CWEs
- CWE-121
References
Raw JSON (NVD)
Show
{
"id": "CVE-2026-55134",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-55134",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-07-15T03:57:01.477674Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "secure@microsoft.com",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Microsoft 365 Apps for Enterprise",
"versions": [
{
"status": "affected",
"version": "16.0.1",
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Office 2019",
"versions": [
{
"status": "affected",
"version": "19.0.0",
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Office 365 for Mac",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "16.111.26071215",
"versionType": "custom"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Office LTSC 2021",
"versions": [
{
"status": "affected",
"version": "16.0.1",
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Office LTSC 2024",
"versions": [
{
"status": "affected",
"version": "16.0.0",
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Office LTSC for Mac 2021",
"versions": [
{
"status": "affected",
"version": "16.0.1",
"lessThan": "16.111.26071215",
"versionType": "custom"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Office LTSC for Mac 2024",
"versions": [
{
"status": "affected",
"version": "16.0.0",
"lessThan": "16.111.26071215",
"versionType": "custom"
}
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SharePoint Enterprise Server 2016",
"versions": [
{
"status": "affected",
"version": "16.0.0",
"lessThan": "16.0.5561.1001",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SharePoint Server 2019",
"versions": [
{
"status": "affected",
"version": "16.0.0",
"lessThan": "16.0.10417.20175",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft SharePoint Server Subscription Edition",
"versions": [
{
"status": "affected",
"version": "16.0.0",
"lessThan": "16.0.19725.20434",
"versionType": "custom"
}
],
"platforms": [
"x64-based Systems"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft Word 2016",
"versions": [
{
"status": "affected",
"version": "16.0.1",
"lessThan": "16.0.5561.1000",
"versionType": "custom"
}
],
"platforms": [
"32-bit Systems",
"x64-based Systems"
]
}
]
}
],
"published": "2026-07-14T18:18:20.163",
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55134",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "secure@microsoft.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"description": [
{
"lang": "en",
"value": "CWE-121"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally."
}
],
"lastModified": "2026-07-16T13:40:01.447",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378"
},
{
"criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*",
"vulnerable": true,
"matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF"
},
{
"criteria": "cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*",
"vulnerable": true,
"matchCriteriaId": "12418BDE-FA2E-4BBF-8E47-45C505399898"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "241CDE2B-ABD0-4EFF-8D73-1766E32FA20F"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2019:-:*:*:*:*:*:x86:*",
"vulnerable": true,
"matchCriteriaId": "14D63E3F-A431-4DD8-979F-811E8DAC423D"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*",
"vulnerable": true,
"matchCriteriaId": "1D518075-3362-4D15-93B1-0E6C61518D16"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*",
"vulnerable": true,
"matchCriteriaId": "1059BEC6-C30B-4F0F-A878-5267A21CBD85"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*",
"vulnerable": true,
"matchCriteriaId": "0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*",
"vulnerable": true,
"matchCriteriaId": "55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*",
"vulnerable": true,
"matchCriteriaId": "8887D177-26A3-4008-89B6-50A9E9830F13"
},
{
"criteria": "cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*",
"vulnerable": true,
"matchCriteriaId": "589B470B-9C2E-41E2-A44D-D8CCB4D2F933"
},
{
"criteria": "cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5FA63EA8-B225-4E35-A6A3-DBDECF5AC4C8",
"versionEndExcluding": "16.0.19725.20434"
},
{
"criteria": "cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F815EF1D-7B60-47BE-9AC2-2548F99F10E4"
},
{
"criteria": "cpe:2.3:a:microsoft:sharepoint_server:2019:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6122D014-5BF1-4AF4-8B4D-80205ED7785E"
},
{
"criteria": "cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:x64:*",
"vulnerable": true,
"matchCriteriaId": "E1FE9E95-4874-46EF-AC93-9E485F7A2AC0"
},
{
"criteria": "cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:x86:*",
"vulnerable": true,
"matchCriteriaId": "38479B5D-66F9-4260-A18A-F6E3D9B6991E"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secure@microsoft.com"
}