Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-55128: Microsoft Word Can Run Malicious Code

CVE-2026-55128 · published 3 months ago

Summary

Microsoft Word on Windows may allow an attacker to run unauthorized code on a user's computer. This could lead to data theft or system damage. To protect yourself, ensure you have the latest updates installed and avoid opening suspicious documents.

What to do

Update microsoft microsoft 365 apps for enterprise to version https://aka.ms/OfficeSecurityReleases or later.
Update microsoft microsoft office 2019 to version https://aka.ms/OfficeSecurityReleases or later.
Update microsoft microsoft office 365 for mac to version 16.111.26071215 or later.
Update microsoft microsoft office ltsc 2021 to version https://aka.ms/OfficeSecurityReleases or later.
Update microsoft microsoft office ltsc 2024 to version https://aka.ms/OfficeSecurityReleases or later.
Update microsoft microsoft office ltsc for mac 2021 to version 16.111.26071215 or later.
Update microsoft microsoft office ltsc for mac 2024 to version 16.111.26071215 or later.
Update microsoft microsoft sharepoint enterprise server 2016 to version 16.0.5561.1001 or later.
Update microsoft microsoft sharepoint server 2019 to version 16.0.10417.20175 or later.
Update microsoft microsoft sharepoint server subscription edition to version 16.0.19725.20434 or later.
Update microsoft microsoft word 2016 to version 16.0.5561.1000 or later.
Update microsoft office_online_server to version 16.0.10417.20175 or later.
Update microsoft sharepoint_server to version 16.0.19725.20434 or later.

Affected software

Vendor	Product	Affected versions
microsoft	microsoft 365 apps for enterprise	< https://aka.ms/OfficeSecurityReleases 16.0.1
microsoft	microsoft office 2019	< https://aka.ms/OfficeSecurityReleases 19.0.0
microsoft	microsoft office 365 for mac	< 16.111.26071215
microsoft	microsoft office ltsc 2021	< https://aka.ms/OfficeSecurityReleases 16.0.1
microsoft	microsoft office ltsc 2024	< https://aka.ms/OfficeSecurityReleases 16.0.0
microsoft	microsoft office ltsc for mac 2021	< 16.111.26071215
microsoft	microsoft office ltsc for mac 2024	< 16.111.26071215
microsoft	microsoft sharepoint enterprise server 2016	< 16.0.5561.1001
microsoft	microsoft sharepoint server 2019	< 16.0.10417.20175
microsoft	microsoft sharepoint server subscription edition	< 16.0.19725.20434
microsoft	microsoft word 2016	< 16.0.5561.1000
microsoft	365_apps	All versions `cpe:2.3:a:microsoft:365_apps:-::::enterprise::x64:*`
microsoft	microsoft_365	All versions `cpe:2.3:a:microsoft:microsoft_365:-:::::macos::`
microsoft	office_2019	All versions `cpe:2.3:a:microsoft:office_2019:-::::::x64:`
microsoft	office_2021	All versions `cpe:2.3:a:microsoft:office_2021:-::::ltsc:-:x64:`
microsoft	office_2024	All versions `cpe:2.3:a:microsoft:office_2024:-::::ltsc:-:x64:`
microsoft	office_online_server	< 16.0.10417.20175 `cpe:2.3:a:microsoft:office_online_server::::::::`
microsoft	sharepoint_server	< 16.0.19725.20434 2016 2019 `cpe:2.3:a:microsoft:sharepoint_server:::::subscription:::*`
microsoft	word	2016 `cpe:2.3:a:microsoft:word:2016::::::x64:`

Original advisory text

Microsoft Word Remote Code Execution Vulnerability

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55128 vendor-advisory patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-416Use After Free

Timeline

Published14 Jul 2026

Updated4 Nov 2026

First seen14 Jul 2026

Sources

CVE-2026-55128 · NVD

CVE-2026-55128 · MITRE

Track software like this

Free during beta