CVE-2026-55129

This flaw is in Microsoft Office’s handling of certain files. If someone sends you a specially built Office document and you open it, Office may be able to run attacker code on your computer.

Think of it like a door lock that can be bypassed with a fake key—opening the “keyed” document is what can let the attacker get in.

This matters if you use Microsoft 365 Apps, Microsoft Office (2016/2019/2021/2024), or any of the affected macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024). It’s specifically a Microsoft Office issue, so any business machine where Office documents are opened could be at risk.

It’s reachable through crafted Office files when someone opens the file (there isn’t a requirement for attackers to have a login).

This is RED because the vulnerability is a code-execution flaw: a crafted file can lead to attacker-controlled code running on the machine that opens it. Even without confirmed “known KEV” listing, Office is widely used, and there’s an available fix from the vendor.

Patch now to eliminate this direct path from malicious documents to full system compromise.