CVE-2026-64903

Think of Microsoft Office like the “engine” that reads documents. This bug is a flaw in how the engine handles a certain kind of document data, which can let a bad document turn into running code on your computer. In real terms, it’s the kind of issue where opening a carefully made file can lead to malware being installed.

This matters if your business uses Microsoft Office on Windows or Mac, especially if employees open emails or documents from outside your company. The risk is tied to interaction with a malicious Office file, so it’s most relevant where phishing or untrusted attachments are possible. The vulnerability is not described as automatic—there must be a user-triggered interaction (for example, opening a malicious document).

Verdict: RED. Even though there is no public exploit code on record and no KEV listing, the bug is being actively tracked and Microsoft has released fixes, and press coverage points to active interest by a major threat actor. Treat this as an urgent patching item for any organization that receives external emails and documents.

1. Inventory the installed Office product:
   • Windows: determine whether you’re on Microsoft 365 apps, Microsoft 365, Office 2016/2019/2021/2024.
   • Mac: determine whether you’re on Microsoft Office 365 for Mac, Office LTSC for Mac 2021, or Office LTSC for Mac 2024.
2. Confirm the exact build/version:
   • In Office, check About/Version (or your IT management tooling) and record the build number.
3. Compare to the fixed versions from Microsoft:
   • Microsoft Office: ensure it’s updated to 16.0.5565.1001.
   • Microsoft 365 apps: ensure you have the latest build from the Microsoft Office Security Releases page (vendor-linked in the findings).
   • Microsoft Office for Mac / LTSC for Mac: ensure it’s updated to 16.112.26081010.
4. Upgrade/patch now:
   • Schedule Office updates for all managed machines and verify they complete successfully.
5. If you cannot patch immediately (temporary containment):
   • Tighten email and attachment handling: block or quarantine unexpected Office attachments.
   • Instruct staff not to open unexpected documents, even if the message “looks normal,” until machines are updated.
6. After patching:
   • Monitor endpoint security alerts for Office-related suspicious activity and verify no Office-triggered malware executions occurred prior to the update.
7. Reference materials:
   • Microsoft remediation guidance for CVE-2026-64903: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64903

Note on timelines: No CISA KEV due date is provided here, and KEV is not listed in the findings.

Severity is high (CVSS 7.8 is provided in the prompt), with the weakness category pointing to integer overflow or wraparound behavior (CWE-122, CWE-190) in Microsoft Office. The practical trigger is interaction with a malicious Office document (the prompt indicates user interaction is required). The findings do not show a KEV entry and do not list public exploit code; however, press attention indicates a patch and references actor interest (Lazarus group). A prediction-only likelihood score is provided in the findings, but it is not used as a basis for urgency versus the confirmed availability of patches and active threat attention.