365Fanatic / M365 Status / Security advisories / CVE-2026-55134

Microsoft Security Update Guide · Office / Microsoft 365 Apps

Microsoft Word Remote Code Execution Vulnerability

Microsoft · EN CVE-2026-55134 Important Action required CVSS 7.8 Updated

Published 14 jul 2026 · updated 22 sep 2026

Summary Detailed Security

What does this mean?

Remote Code Execution. An attacker can run their own code on the system remotely. This is the most serious type: it can lead to taking over the system.
It can be exploited with access to the device itself, without an account and if a user takes part, for example by opening a link or file.
CVSS 7.8 out of 10: high. Microsoft rates it Important.
No attacks reported; Microsoft expects exploitation to be less likely.
What should you do? Install the security update for the version you run (or a later cumulative update):
- Microsoft Office LTSC for Mac 2024: KBRelease Notes 16.111.26071215
- Microsoft Office LTSC 2024 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2024 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
- Microsoft SharePoint Server Subscription Edition: KB5002882 16.0.19725.20434
- Microsoft Office LTSC 2021 for 32-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases
- Microsoft Office LTSC 2021 for 64-bit editions: KBClick to Run https://aka.ms/OfficeSecurityReleases

Microsoft Office Word · Remote Code Execution

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Office / Microsoft 365 Apps

How do I check if I am affected?

SharePoint Server: check and update

Check your farm build in the SharePoint Management Shell:
```
(Get-SPFarm).BuildVersion
```
Or in Central Administration → Upgrade and Migration → Check product and patch installation status.
If the build is equal to or higher than the build under "Affected products and updates" below, this vulnerability is fixed. A later cumulative update includes the fix too.

Otherwise install the update on every server in the farm, then run the SharePoint Products Configuration Wizard, or:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

You do not need to update SharePoint Online in Microsoft 365; Microsoft does that.

Key facts

Released

14 jul 2026

Last revised

22 sep 2026 (v1.3)

Impact

Remote Code Execution

Max severity

Important

Weakness

CWE-121: Stack-based Buffer Overflow

CVSS 3.1

7.8 / 6.8 (base / temporal)

Vector string

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Publicly disclosed

Exploited

Exploitability assessment

Exploitation Unlikely

Customer action required

Yes

Links

Microsoft Security Update Guide · CVE.org

CVSS metrics

Base score metrics
Attack Vector	Local
Attack Complexity	Low
Privileges Required	None
User Interaction	Required
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High
Temporal score metrics
Exploit Code Maturity	Unproven
Remediation Level	Official Fix
Report Confidence	Confirmed

Affected products and updates

Product	Update	Build
Microsoft Office LTSC for Mac 2024	KBRelease Notes · Security Update	`16.111.26071215`
Microsoft Office LTSC 2024 for 64-bit editions	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`
Microsoft Office LTSC 2024 for 32-bit editions	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`
Microsoft SharePoint Server Subscription Edition	KB5002882 · Security Update	`16.0.19725.20434`
Microsoft Office LTSC 2021 for 32-bit editions	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`
Microsoft Office LTSC 2021 for 64-bit editions	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`
Microsoft Word 2016 (64-bit edition)	KB5002890 · Security Update	`16.0.5561.1000`
Microsoft Word 2016 (32-bit edition)	KB5002890 · Security Update	`16.0.5561.1000`
Microsoft Office LTSC for Mac 2021	KBRelease Notes · Security Update	`16.111.26071215`
Microsoft 365 Apps for Enterprise for 64-bit Systems	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`
Microsoft 365 Apps for Enterprise for 32-bit Systems	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`
Microsoft Office 2019 for 64-bit editions	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`
Microsoft Office 2019 for 32-bit editions	KBClick to Run	`https://aka.ms/OfficeSecurityReleases`
Microsoft SharePoint Server 2019	KB5002883 · Security Update	`16.0.10417.20175`
Microsoft SharePoint Server 2019	KB5002885 · Security Update	`16.0.10417.20175`
Microsoft SharePoint Enterprise Server 2016	KB5002891 · Security Update	`16.0.5561.1001`
Microsoft SharePoint Enterprise Server 2016	KB5002892 · Security Update	`16.0.5561.1001`
Microsoft Office 365 for Mac	KBRelease Notes · Security Update	`16.111.26071215`

FAQ

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?: The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?: An attacker must send a user a malicious Office file and convince them to open it.
Is the Preview Pane an attack vector for this vulnerability?: No, the Preview Pane is not an attack vector.

Revisions

Version	Date	Note
1.3	22 sep 2026	Updated an acknowledgement. This is an informational change only.
1.2	31 aug 2026	Updated an acknowledgement. This is an informational change only.
1.1	21 aug 2026	Updated an acknowledgement. This is an informational change only.
1	14 jul 2026	Information published.

This is in the weekly digest for week 39 · What changed this week? →

View at Microsoft → ← All security advisories

Source: Microsoft Security Update Guide. 365Fanatic is not affiliated with Microsoft.