CVE-2026-55124 - Vulnerability Details

- Microsoft Word Information Disclosure Vulnerability

Description

Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

Published: 2026-07-14

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Microsoft Office Word contains an improper input validation flaw that allows an unauthorized local user to disclose sensitive information. This vulnerability is mapped to CWE‑20 (Improper Input Validation) and CWE‑1287 (Information Disclosure).

Affected Systems

The flaw affects a broad range of Microsoft Office products, including Microsoft 365 Apps for Enterprise, Office 2019, Office 2021, Office 2024, Office 365 for Mac, Office LTSC 2021 and 2024, Office LTSC for Mac 2021 and 2024, and Word 2016. SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition are also affected. Version detail is not specified in the CVE.

Risk and Exploitability

With a CVSS score of 5.5 the vulnerability is considered moderate. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is local only; an attacker must already have local access to a machine and exploit the flaw by submitting a crafted input that triggers the improper validation. As it is not listed in the CISA KEV catalog, there are no known widespread exploits, but the limited exploitability does not eliminate the need for vigilance.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Microsoft 365 Apps for Enterprise

affected

Version	Status	Constraints
`16.0.1`	affected	< https://aka.ms/OfficeSecurityReleases

Microsoft

Microsoft Office 2019

affected

Version	Status	Constraints
`19.0.0`	affected	< https://aka.ms/OfficeSecurityReleases

Microsoft

Microsoft Office 365 for Mac

affected

Version	Status	Constraints
`1.0.0`	affected	< 16.111.26071215

Microsoft

Microsoft Office LTSC 2021

affected

Version	Status	Constraints
`16.0.1`	affected	< https://aka.ms/OfficeSecurityReleases

Microsoft

Microsoft Office LTSC 2024

affected

Version	Status	Constraints
`16.0.0`	affected	< https://aka.ms/OfficeSecurityReleases

Microsoft

Microsoft Office LTSC for Mac 2021

affected

Version	Status	Constraints
`16.0.1`	affected	< 16.111.26071215

Microsoft

Microsoft Office LTSC for Mac 2024

affected

Version	Status	Constraints
`16.0.0`	affected	< 16.111.26071215

Microsoft

Microsoft SharePoint Enterprise Server 2016

affected

Version	Status	Constraints
`16.0.0`	affected	< 16.0.5561.1001

Microsoft

Microsoft SharePoint Server 2019

affected

Version	Status	Constraints
`16.0.0`	affected	< 16.0.10417.20175

Microsoft

Microsoft SharePoint Server Subscription Edition

affected

Version	Status	Constraints
`16.0.0`	affected	< 16.0.19725.20434

Microsoft

Microsoft Word 2016

affected

Version	Status	Constraints
`16.0.1`	affected	< 16.0.5561.1000

No data.

Vendor Product Confidence Versions

Microsoft

365 Apps

95%

Version	Status	Scheme	Platform
`[16.0.1,*]`	affected	semver	['32-bit_systems', 'x64-based_systems']

Microsoft

Office 2019

95%

Version	Status	Scheme	Platform
`[19.0.0,*]`	affected	semver	['32-bit_systems', 'x64-based_systems']

Microsoft

Office 2021

95%

Version	Status	Scheme	Platform
`[16.0.1,*]`	affected	semver	['32-bit_systems', 'x64-based_systems']

Microsoft

Office 2024

95%

Version	Status	Scheme	Platform
`[16.0.0,*]`	affected	semver	['32-bit_systems', 'x64-based_systems']

Microsoft

Office 365

95%

Version	Status	Scheme	Platform
`[1.0.0,16.111.26071215)`	affected	generic	['macos']

Microsoft

Office Macos 2021

95%

Version	Status	Scheme	Platform
`[16.0.1,16.111.26071215)`	affected	generic	['long_term_servicing_channel']

Microsoft

Office Macos 2024

95%

Version	Status	Scheme	Platform
`[16.0.0,16.111.26071215)`	affected	generic	['long_term_servicing_channel']

Microsoft

Sharepoint Server

95%

Version	Status	Scheme	Platform
`[16.0.0,16.0.19725.20434)`	affected	generic	—

Microsoft

Sharepoint Server 2016

95%

Version	Status	Scheme	Platform
`[16.0.0,16.0.5561.1001)`	affected	generic	['enterprise']

Microsoft

Sharepoint Server 2019

95%

Version	Status	Scheme	Platform
`[16.0.0,16.0.10417.20175)`	affected	generic	—

Microsoft

Word 2016

95%

Version	Status	Scheme	Platform
`[16.0.1,16.0.5561.1000)`	affected	generic	['32-bit_systems', 'x64-based_systems']

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply all current Microsoft Office and SharePoint security updates that address CVE-2026-55124.
Limit local access to documents and input types that could trigger the flaw by applying file permissions, group restrictions, or containerization.
Enforce least authorized users can create or modify Office documents on vulnerable systems.

Generated by OpenCVE AI on July 31, 2026 at 06:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00421.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55124

History

Thu, 16 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 14 Jul 2026 17:45:00 +0000

Type	Values Removed	Values Added
Description		Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
Title		Microsoft Word Information Disclosure Vulnerability
First Time appeared		Microsoft Microsoft 365 Apps Microsoft office 2019 Microsoft office 2021 Microsoft office 2024 Microsoft office 365 Microsoft office Macos 2021 Microsoft office Macos 2024 Microsoft sharepoint Server Microsoft sharepoint Server 2016 Microsoft sharepoint Server 2019 Microsoft word 2016
Weaknesses		CWE-1287 CWE-20
CPEs		cpe:2.3:a:microsoft:365_apps:::::enterprise:::* cpe:2.3:a:microsoft:office_2019:::::::: cpe:2.3:a:microsoft:office_2021:::::long_term_servicing_channel:::* cpe:2.3:a:microsoft:office_2024:::::long_term_servicing_channel:::* cpe:2.3:a:microsoft:office_365::::::macos::* cpe:2.3:a:microsoft:office_macos_2021::::::long_term_servicing_channel::* cpe:2.3:a:microsoft:office_macos_2024::::::long_term_servicing_channel::* cpe:2.3:a:microsoft:sharepoint_server:::::subscription:::* cpe:2.3:a:microsoft:sharepoint_server_2016:::::enterprise:::* cpe:2.3:a:microsoft:sharepoint_server_2019:::::::: cpe:2.3:a:microsoft:word_2016::::::::
Vendors & Products		Microsoft Microsoft 365 Apps Microsoft office 2019 Microsoft office 2021 Microsoft office 2024 Microsoft office 365 Microsoft office Macos 2021 Microsoft office Macos 2024 Microsoft sharepoint Server Microsoft sharepoint Server 2016 Microsoft sharepoint Server 2019 Microsoft word 2016
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55124
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C'}`

Subscriptions

Microsoft 365 Apps Office 2019 Office 2021 Office 2024 Office 365 Office Macos 2021 Office Macos 2024 Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019 Word 2016

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-07-14T17:08:47.741Z

Updated: 2026-08-03T22:57:07.910Z

Reserved: 2026-06-16T15:03:49.680Z

Link: CVE-2026-55124

Vulnrichment

Updated: 2026-07-14T19:07:58.292Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-31T07:00:08Z

Weaknesses

CWE-1287
Improper Validation of Specified Type of Input
CWE-20
Improper Input Validation

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object