{"id":"CVE-2026-55124","aliases":[],"cve":{"records":[{"id":"CVE-2026-55124","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-16T15:03:49.680Z","published":"2026-07-14T17:08:47.741Z","modified":"2026-10-28T20:05:27.563Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-10-28T20:05:27.563Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-07-14T19:08:30.186Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55124","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-1287","description":"CWE-1287: Improper Validation of Specified Type of Input","source":"microsoft"},{"id":"CWE-20","description":"CWE-20: Improper Input Validation","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sharepoint_server_2016:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.0.5561.1001"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sharepoint_server_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.0.10417.20175"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"19.0.0","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_macos_2021:*:*:*:*:*:long_term_servicing_channel:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"16.111.26071215"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:sharepoint_server:*:*:*:*:subscription:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.0.19725.20434"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"https://aka.ms/OfficeSecurityReleases"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_macos_2024:*:*:*:*:*:long_term_servicing_channel:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.111.26071215"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:word_2016:*:*:*:*:*:*:*:*","versionStartIncluding":"16.0.1","versionEndExcluding":"16.0.5561.1000"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_365:*:*:*:*:*:macos:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"16.111.26071215"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-07-14T19:07:32.233924Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Microsoft Word Information Disclosure Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.","score":5.5,"severity":"medium","published":"2026-07-14T17:08:47.741Z","modified":"2026-10-28T20:05:27.563Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Microsoft 365 Apps for Enterprise","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-55124"},{"vendor":"Microsoft","name":"Microsoft Office 2019","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"19.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-55124"},{"vendor":"Microsoft","name":"Microsoft Office 365 for Mac","platforms":[],"versions":[{"version":"1.0.0","status":"affected","lessThan":"16.111.26071215","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-55124"},{"vendor":"Microsoft","name":"Microsoft Office LTSC 2021","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.1","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-55124"},{"vendor":"Microsoft","name":"Microsoft Office LTSC 2024","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.0","status":"affected","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-55124"},{"vendor":"Microsoft","name":"Microsoft Office LTSC for Mac 2021","platforms":[],"versions":[{"version":"16.0.1","status":"affected","lessThan":"16.111.26071215","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-55124"},{"vendor":"Microsoft","name":"Microsoft Office LTSC for Mac 2024","platforms":[],"versions":[{"version":"16.0.0","status":"affected","lessThan":"16.111.26071215","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-55124"},{"vendor":"Microsoft","name":"Microsoft SharePoint Enterprise Server 2016","platforms":["x64-based Systems"],"versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.5561.1001","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-55124"},{"vendor":"Microsoft","name":"Microsoft SharePoint Server 2019","platforms":["x64-based Systems"],"versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.10417.20175","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-55124"},{"vendor":"Microsoft","name":"Microsoft SharePoint Server Subscription Edition","platforms":["x64-based Systems"],"versions":[{"version":"16.0.0","status":"affected","lessThan":"16.0.19725.20434","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-55124"},{"vendor":"Microsoft","name":"Microsoft Word 2016","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.1","status":"affected","lessThan":"16.0.5561.1000","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-55124"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55124"],"sources":[{"name":"CVE","id":"CVE-2026-55124","modified":"2026-10-28T20:05:27.563Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-55124"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","score":5.5}],"sourceAffected":[],"observedAt":"2026-10-29T14:39:53.549Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T00:50:33.640Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Microsoft Word has an information disclosure vulnerability due to improper validation of input, affecting versions like 16.0.1 of Microsoft 365 Apps for Enterprise and 19.0.0 of Microsoft Office 2019. An unauthorized attacker may disclose information locally.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:34:05.342Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-55124"}]}}