This vulnerability is a stack-based buffer overflow (CWE-121) in Microsoft Office Word as part of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute code locally, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS 3.1 vector indicates local attack vector with low attack complexity, no privileges required, but user interaction is needed. Microsoft has published an official fix and manages remediation for this cloud-hosted service. No known active exploitation has been reported.

Successful exploitation allows local code execution by an unauthorized attacker, resulting in high impact on confidentiality, integrity, and availability of the affected system. This could lead to complete system compromise if exploited.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users and administrators should ensure their Microsoft 365 Apps for Enterprise environment is updated according to Microsoft's guidance in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55055. No additional user action is required beyond applying the official fix.