CVE-2026-64898

This is a Microsoft Office weakness where a bad file can cause Office to behave in an unsafe way. If an attacker sends you a crafted document and someone opens it, Office could run attacker-controlled code on the device—like turning a normal document into a launch point for malware.

This matters if your business uses Microsoft 365 Apps, Microsoft Office (including Microsoft Office 365 for Mac and the listed Office LTSC for Mac versions), or Office 2019/2021/2024 on workstations or other endpoints. It becomes a risk when an attacker can get a user to open a malicious Office document in your environment. The attack does not require you to have previously installed anything unsafe—your exposure is driven by having the vulnerable Office version and the ability for attackers to deliver a crafted file to your users.

This is a RED issue because Microsoft has released fixes and the vulnerability involves remote code execution triggered by opening a malicious Office document. In practice, Office document–based attacks are a common route for attackers, and press attention indicates active focus on this topic. Act immediately to get all affected Office installs updated to the fixed versions.

1. Identify exposure on all endpoints:

   • For Windows: check which of these you run—microsoft 365 apps, microsoft office, microsoft 365, office 2019, office 2021, office 2024.
   • For macOS: check whether you run Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, or Microsoft Office LTSC for Mac 2024.
   • Record the current Office build/version on each device.

2. Apply the vendor-published fix:

   • Windows and general Microsoft Office releases:
     • Use Microsoft’s guidance for CVE-2026-64898 and upgrade to the fixed builds shown on the Office Security Releases page: https://aka.ms/OfficeSecurityReleases
     • You can also cross-check the specific update guidance here: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64898
   • macOS (explicit fixed version is provided by Microsoft):
     • Update Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024 to version 16.112.26081010.

3. Validate after patching:

   • Re-check the Office build/version on each updated device to confirm it matches the patched release.
   • Ensure Office updates are not deferred/blocked (so devices don’t quietly fall back to an older build).

4. If you cannot patch immediately:

   • Treat opening email attachments and shared documents as higher risk until updated.
   • Reduce the chance of users opening untrusted Office files (for example, tighten attachment handling and limit who can open documents from untrusted sources) while you schedule the update.

5. What to monitor:

   • Look for signs of Office-related suspicious behavior shortly after document opens (unusual processes launched by Office, unexpected outbound connections, or rapid changes on the affected endpoint). Use your normal endpoint logging/EDR tooling for this monitoring.

CVE-2026-64898 is a Microsoft Office vulnerability classified under CWE-122 (heap-based buffer overflow) and CWE-190 (integer overflow/related memory safety weakness category). The weakness can be triggered by an attacker delivering a crafted Office document such that when a user opens it, the vulnerable code path can be reached to achieve local code execution in the context of the user process (remote code execution in the sense that the attacker sends the file).

Exploitation status: no public exploit code is on record and the vulnerability is not listed in CISA KEV based on the provided findings. EPSS is listed as a low predicted likelihood (do not rely on this alone); the traffic-light verdict remains RED due to the high-impact nature and Microsoft’s patch release.

Patch status: Microsoft has published fixed releases, including an explicit macOS fixed version of 16.112.26081010 for Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Windows/Microsoft 365 Apps and other Microsoft Office products are addressed via the Office Security Releases guidance for CVE-2026-64898.

KEV meaning here: not being in CISA KEV (per the findings) indicates it is not confirmed there at this time, but it does not reduce the importance of patching because successful document-delivery attacks can still occur outside KEV documentation.