Use of uninitialized resource in Microsoft Office for macOS and Microsoft Office - CVE-2026-55042

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of an uninitialized resource in Microsoft Office when parsing a crafted Office file. A remote attacker can send a malicious Office file and convince the user to open it to disclose sensitive information.

The Preview Pane is an attack vector, and successful exploitation could allow reading small portions of heap memory.

Affected software

How to mitigate CVE-2026-55042

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-55042
• https://support.microsoft.com/help/5002887

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office