KB5002855 — Security Update for Office Online Server

Overview

KB5002855 is a critical security update released on April 14, 2026, for Office Online Server. This update addresses multiple security vulnerabilities including remote code execution flaws and information disclosure issues that could allow attackers to compromise server integrity and access sensitive document data.

Issue Description

This security update addresses several critical vulnerabilities in Office Online Server that could be exploited by attackers:

• Remote Code Execution Vulnerability (CVE-2026-0142): Improper validation of user-supplied data in document rendering engine could allow remote code execution
• Information Disclosure Vulnerability (CVE-2026-0143): Authentication bypass in Office Web Apps service could expose sensitive document metadata
• Privilege Escalation Vulnerability (CVE-2026-0144): Insufficient access controls in document conversion service could allow unauthorized privilege escalation
• Cross-Site Scripting Vulnerability (CVE-2026-0145): Improper input sanitization in web interface could enable XSS attacks

These vulnerabilities could be exploited through specially crafted documents or malicious web requests targeting Office Online Server installations.

Root Cause

The vulnerabilities stem from insufficient input validation and improper security controls in multiple Office Online Server components. The document rendering engine fails to properly validate user-supplied data, while authentication mechanisms contain logic flaws that can be bypassed. Additionally, inadequate access controls in the document conversion service allow for potential privilege escalation attacks.

Applies To

This security update applies to the following Office Online Server versions:

Resolution — Security Fixes

1. Fixes remote code execution vulnerability in document rendering engine (CVE-2026-0142)

This update strengthens input validation in the Office Online Server document rendering engine. The fix implements enhanced bounds checking and data sanitization for user-supplied content in Word, Excel, and PowerPoint documents. The update modifies the Microsoft.Office.Web.Common.dll and Microsoft.Office.Web.Word.dll components to prevent buffer overflow conditions that could lead to remote code execution.

2. Resolves authentication bypass vulnerability in Office Web Apps service (CVE-2026-0143)

The update patches a critical authentication bypass flaw in the Office Web Apps service that could allow unauthorized access to document metadata. The fix strengthens the authentication validation logic in Microsoft.Office.Web.Host.dll and implements additional security checks for session token validation. This prevents attackers from bypassing authentication mechanisms to access sensitive document information.

3. Addresses privilege escalation vulnerability in document conversion service (CVE-2026-0144)

This security fix implements proper access controls in the Office Online Server document conversion service. The update modifies the Microsoft.Office.Web.Conversion.dll component to enforce strict permission checks and prevent unauthorized privilege escalation. The fix ensures that document conversion operations run with appropriate security context and cannot be exploited to gain elevated system privileges.

4. Eliminates cross-site scripting vulnerability in web interface (CVE-2026-0145)

The update implements comprehensive input sanitization in the Office Online Server web interface to prevent XSS attacks. The fix modifies client-side JavaScript components and server-side validation routines in Microsoft.Office.Web.UI.dll to properly encode user input and prevent script injection. This protects users from malicious scripts that could be executed in their browser context.

5. Enhances overall security posture with additional hardening measures

Beyond addressing specific CVEs, this update includes additional security hardening measures for Office Online Server. These include improved error handling to prevent information leakage, enhanced logging for security events, and strengthened cryptographic implementations. The update also includes performance optimizations for security validation routines to minimize impact on server performance.

Installation

KB5002855 is available through multiple deployment channels for Office Online Server environments:

Microsoft Update Catalog

Download the update package directly from Microsoft Update Catalog. The update is available as an MSP (Microsoft Patch) file with the following specifications:

• File name: oos2016-kb5002855-fullfile-x64-glb.msp (Office Online Server 2016)
• File name: oos2019-kb5002855-fullfile-x64-glb.msp (Office Online Server 2019)
• File name: oos2022-kb5002855-fullfile-x64-glb.msp (Office Online Server 2022)
• File size: Approximately 85-120 MB depending on version
• Restart required: Yes, Office Online Server services restart required

Windows Server Update Services (WSUS)

The update is automatically synchronized to WSUS servers configured for Office updates. Administrators can approve and deploy the update through WSUS management console.

System Center Configuration Manager (SCCM)

Deploy through SCCM software update management. The update appears in the Microsoft Office Updates classification.

Prerequisites

• Office Online Server must be running a supported version (2016, 2019, or 2022)
• Minimum 500 MB free disk space on system drive
• Administrative privileges required for installation
• All Office Online Server services must be stopped during installation

Known Issues

The following issues have been identified after installing KB5002855:

Document Conversion Service Startup Delay

Some administrators have reported increased startup time for the Office Online Server document conversion service after installing this update. The service may take an additional 30-60 seconds to fully initialize due to enhanced security validation routines.

Workaround: Adjust service startup timeout values in the Windows Service Control Manager if automatic startup fails. Use the following PowerShell command to increase timeout:

Set-Service -Name "Office Online Server" -StartupType Automatic
sc.exe config "Office Online Server" start= delayed-auto

Authentication Token Refresh Issues

Users may experience authentication token refresh issues when accessing documents through SharePoint integration. This affects long-running document editing sessions.

Workaround: Configure shorter authentication token lifetime in SharePoint Central Administration or advise users to save work frequently and refresh their browser session.

Performance Impact on Large Document Processing

Processing of large documents (>50 MB) may experience slight performance degradation due to enhanced security validation. This primarily affects Excel workbooks with extensive data sets.

Workaround: No workaround available. Performance impact is typically 5-10% and is considered acceptable for the security improvements provided.