CVE-2026-55018

Think of this as a “memory handling” mistake in Microsoft Office. If an employee opens a specially crafted Office document, the document can potentially trick Office into running attacker code on that same computer—like installing a program through the file, not through a website login.

This matters if you run Microsoft Office products on Windows or macOS—specifically Microsoft 365 Apps, Microsoft Office, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. The protection gap is triggered when a user opens a malicious Office file, so it’s most relevant to businesses where staff receive external emails or download documents. This is only a risk if an attacker can get a user to open a crafted file in Office.

This is a high-impact Office flaw that can allow attackers to run code on the machine after a user opens a malicious document. Treat it as urgent because Office is commonly used across small businesses and the path to trigger it is a normal workflow (opening an attachment).