CVE-2026-55124

Microsoft Word Information Disclosure Vulnerability

Published Jul 14, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Analysis

Technical impact

Microsoft Office Word contains an improper input validation flaw that allows an unauthorized local user to disclose sensitive information. This vulnerability is mapped to CWE‑20 (Improper Input Validation) and CWE‑1287 (Information Disclosure).

Affected Systems

The flaw affects a broad range of Microsoft Office products, including Microsoft 365 Apps for Enterprise, Office 2019, Office 2021, Office 2024, Office 365 for Mac, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, and Word 2016. SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition are also affected. Version detail is not specified in the CVE.

Risk and Exploitability

With a CVSS score of 5.5 the vulnerability is considered moderate. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is local only; an attacker must already have local access to a machine and exploit the flaw by submitting a crafted input that triggers the improper validation. As it is not listed in the CISA KEV catalog, there are no known widespread exploits, but the limited exploitability does not eliminate the need for vigilance.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Microsoft 365 Apps for Enterprise

affected

Version	Status	Constraints
`16.0.1`	affected	< https://aka.ms/OfficeSecurityReleases

Microsoft

Microsoft Office 2019

affected

Version	Status	Constraints
`19.0.0`	affected	< https://aka.ms/OfficeSecurityReleases

Microsoft

Microsoft Office 365 for Mac

affected

Version	Status	Constraints
`1.0.0`	affected	< 16.111.26071215

Microsoft

Microsoft Office LTSC 2021

affected

Version	Status	Constraints
`16.0.1`	affected	< https://aka.ms/OfficeSecurityReleases

Microsoft

Microsoft Office LTSC 2024

affected

Version	Status	Constraints
`16.0.0`	affected	< https://aka.ms/OfficeSecurityReleases

Microsoft

Microsoft Office LTSC for Mac 2021

affected

Version	Status	Constraints
`16.0.1`	affected	< 16.111.26071215

Microsoft

Microsoft Office LTSC for Mac 2024

affected

Version	Status	Constraints
`16.0.0`	affected	< 16.111.26071215

Microsoft

Microsoft SharePoint Enterprise Server 2016

affected

Version	Status	Constraints
`16.0.0`	affected	< 16.0.5561.1001

Microsoft

Microsoft SharePoint Server 2019

affected

Version	Status	Constraints
`16.0.0`	affected	< 16.0.10417.20175

Microsoft

Microsoft SharePoint Server Subscription Edition

affected

Version	Status	Constraints
`16.0.0`	affected	< 16.0.19725.20434

Microsoft

Microsoft Word 2016

affected

Version	Status	Constraints
`16.0.1`	affected	< 16.0.5561.1000

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:365_apps:-::::enterprise::x64:*
	cpe:2.3:a:microsoft:365_apps:-::::enterprise::x86:*
	cpe:2.3:a:microsoft:microsoft_365:-:::::macos::
	cpe:2.3:a:microsoft:office_2019:-::::::x64:
	cpe:2.3:a:microsoft:office_2019:-::::::x86:
	cpe:2.3:a:microsoft:office_2021:-::::ltsc:-:x64:
	cpe:2.3:a:microsoft:office_2021:-::::ltsc:-:x86:
	cpe:2.3:a:microsoft:office_2021:-::::ltsc:macos:-:
	cpe:2.3:a:microsoft:office_2024:-::::ltsc:-:x64:
	cpe:2.3:a:microsoft:office_2024:-::::ltsc:-:x86:
	cpe:2.3:a:microsoft:office_2024:-::::ltsc:macos:-:
	cpe:2.3:a:microsoft:office_online_server::::::::
	cpe:2.3:a:microsoft:sharepoint_server:::::subscription:::*
	cpe:2.3:a:microsoft:sharepoint_server:2016::::enterprise:::
	cpe:2.3:a:microsoft:sharepoint_server:2019:::::::*
	cpe:2.3:a:microsoft:word:2016::::::x64:
	cpe:2.3:a:microsoft:word:2016::::::x86:

No data.

Vendor Product Versions

Microsoft

365 Apps

Version	Status	Scheme	Platform
`[16.0.1,*]`	affected	semver	['32-bit_systems', 'x64-based_systems']

Microsoft

Office 2019

Version	Status	Scheme	Platform
`[19.0.0,*]`	affected	semver	['32-bit_systems', 'x64-based_systems']

Microsoft

Office 2021

Version	Status	Scheme	Platform
`[16.0.1,*]`	affected	semver	['32-bit_systems', 'x64-based_systems']

Microsoft

Office 2024

Version	Status	Scheme	Platform
`[16.0.0,*]`	affected	semver	['32-bit_systems', 'x64-based_systems']

Microsoft

Office 365

Version	Status	Scheme	Platform
`[1.0.0,16.111.26071215)`	affected	generic	['macos']

Microsoft

Office Macos 2021

Version	Status	Scheme	Platform
`[16.0.1,16.111.26071215)`	affected	generic	['long_term_servicing_channel']

Microsoft

Office Macos 2024

Version	Status	Scheme	Platform
`[16.0.0,16.111.26071215)`	affected	generic	['long_term_servicing_channel']

Microsoft

Sharepoint Server

Version	Status	Scheme	Platform
`[16.0.0,16.0.19725.20434)`	affected	generic	—

Microsoft

Sharepoint Server 2016

Version	Status	Scheme	Platform
`[16.0.0,16.0.5561.1001)`	affected	generic	['enterprise']

Microsoft

Sharepoint Server 2019

Version	Status	Scheme	Platform
`[16.0.0,16.0.10417.20175)`	affected	generic	—

Microsoft

Word 2016

Version	Status	Scheme	Platform
`[16.0.1,16.0.5561.1000)`	affected	generic	['32-bit_systems', 'x64-based_systems']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply all current Microsoft Office and SharePoint security updates that address CVE-2026-55124.
Limit local access to documents and input types that could trigger the flaw by applying file permissions, group restrictions, or containerization.
Enforce least authorized users can create or modify Office documents on vulnerable systems.

Generated by OpenCVE AI on July 31, 2026 at 06:56 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.595% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55124

History

Jul 16, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 5:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
Title		Microsoft Word Information Disclosure Vulnerability
First Time appeared		Microsoft Microsoft 365 Apps Microsoft office 2019 Microsoft office 2021 Microsoft office 2024 Microsoft office 365 Microsoft office Macos 2021 Microsoft office Macos 2024 Microsoft sharepoint Server Microsoft sharepoint Server 2016 Microsoft sharepoint Server 2019 Microsoft word 2016
Weaknesses		CWE-1287 CWE-20
CPEs		cpe:2.3:a:microsoft:365_apps:::::enterprise:::* cpe:2.3:a:microsoft:office_2019:::::::: cpe:2.3:a:microsoft:office_2021:::::long_term_servicing_channel:::* cpe:2.3:a:microsoft:office_2024:::::long_term_servicing_channel:::* cpe:2.3:a:microsoft:office_365::::::macos::* cpe:2.3:a:microsoft:office_macos_2021::::::long_term_servicing_channel::* cpe:2.3:a:microsoft:office_macos_2024::::::long_term_servicing_channel::* cpe:2.3:a:microsoft:sharepoint_server:::::subscription:::* cpe:2.3:a:microsoft:sharepoint_server_2016:::::enterprise:::* cpe:2.3:a:microsoft:sharepoint_server_2019:::::::: cpe:2.3:a:microsoft:word_2016::::::::
Vendors & Products		Microsoft Microsoft 365 Apps Microsoft office 2019 Microsoft office 2021 Microsoft office 2024 Microsoft office 365 Microsoft office Macos 2021 Microsoft office Macos 2024 Microsoft sharepoint Server Microsoft sharepoint Server 2016 Microsoft sharepoint Server 2019 Microsoft word 2016
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55124
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C'}`

Subscriptions

Microsoft 365 Apps Microsoft 365 Office 2019 Office 2021 Office 2024 Office 365 Office Macos 2021 Office Macos 2024 Office Online Server Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019 Word Word 2016

Weaknesses