CVE-2026-55132

This is a flaw in Microsoft Word that can “break” how data is handled when a specially crafted document is opened. If an attacker manages to get you to open that document, the bug can let them run malicious code on the computer you’re using. It’s like a booby-trapped invoice file—opening it can hand control of your device to the attacker, under your user account.

This matters if your business uses Microsoft Word or Microsoft Office/Microsoft 365 apps, including the listed macOS Office versions, Microsoft Word 2016, and the listed Microsoft SharePoint Server editions. The core issue does not require an attacker to have a login, but it does require that a user opens a crafted document. The risk is therefore tied to whether your environment allows untrusted Word files to be opened (for example via email, downloads, or shared files).

This is RED because attackers only need to get a victim to open a malicious Word document to trigger local code execution, and Microsoft has provided fixed versions for multiple Office and SharePoint products. While the findings provided do not confirm active exploitation in the news, the impact is high and the patch is available now. Treat this as an urgent update to reduce the chance of a successful document-based attack against your endpoints.