Type Confusion in Microsoft Office for macOS and Microsoft Office - CVE-2026-55022

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to access of resource using incompatible type ('type confusion') in Microsoft Office when parsing a crafted Office file. A remote attacker can send a specially crafted Office file and convince the victim to open it to execute arbitrary code.

The Preview Pane can be used as an attack vector, and user interaction is required.

Affected software

How to mitigate CVE-2026-55022

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-55022
• https://www.microsoft.com/en-us/microsoft-365/mac/microsoft-365-for-mac?msockid=35f9adb0e74b61392038b90de6fe608c

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office