CVE-2026-64907

Microsoft Office Word Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 38th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile38th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-14Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which Microsoft Office/Word version your business runs (Windows and/or Mac), and confirm whether you have Microsoft Word from the affected list installed.
Update Microsoft 365 Apps / Microsoft Office to the patched release shown in https://aka.ms/OfficeSecurityReleases.
On Microsoft Office for Mac / Microsoft Office LTSC for Mac 2021 / Microsoft Office LTSC for Mac 2024, update to version 16.112.26081010.
If you can’t update immediately, stop users from opening email attachments and documents from unknown senders, and temporarily block risky attachment types at the email gateway until patched.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

A Microsoft Word security flaw can let attackers run harmful code when someone opens a specially made document; you should act quickly if your business uses Microsoft Office Word (most Microsoft 365 and Office installs need an update).

CVE-2026-64907 is a Microsoft Word remote code execution vulnerability caused by a stack-based buffer overflow (CWE-121) that can be triggered by user interaction when opening a crafted Word document; required fixed updates are available for Microsoft 365/Office and for Microsoft Office for Mac (including LTSC).

If you're affected

Malicious code execution
Company data theft
Ransomware/crypto risk
Business disruption

What is it

Think of Microsoft Word as a document reader. This vulnerability is like a “crash-and-run” bug: with a specially crafted document, an attacker may be able to get Word to run code on your computer when a person opens the file—turning a document into an attack delivery method.

Who is affected

This matters if your business uses Microsoft Word as part of Microsoft 365 apps, Microsoft Office (including Office 2019/2021/2024), or Microsoft Office for Mac / Office LTSC for Mac. Because the attack requires someone to open a crafted document, the main risk is phishing or targeted emails that trick staff into opening the file. Act as if you’re exposed if you have affected Office/Word installed and users can receive external documents (the document must be opened to trigger the issue).

How urgent is it

This is marked RED because the underlying issue is serious (remote code execution) and Microsoft has already issued a patch, alongside reporting that an advanced actor (Lazarus group) is associated with the activity driving attention. Even though there’s no public exploit code on record and no CISA KEV listing, your best protection is to update promptly to the fixed Office releases listed by Microsoft.

What to do — in detail

Confirm exposure (what to check)
- Identify every Office product installed across your environment that maps to the affected list: Microsoft 365 apps / Microsoft 365, Office 2019/2021/2024, and Word on Windows, plus Microsoft Office for Mac / Microsoft Office LTSC for Mac 2021 / Microsoft Office LTSC for Mac 2024.
- On Windows, check Word’s version/build in Word itself (About) or via your device management tool.
- On macOS, check the Office build/version number shown in Word’s About.
Apply the fixed versions
- Microsoft 365 Apps and Microsoft Office (Windows): upgrade to the patched release available via Microsoft’s Office security releases hub: https://aka.ms/OfficeSecurityReleases.
- Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024: update to version 16.112.26081010.
- For exact guidance tied to this CVE, follow Microsoft’s update guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64907.
Branch-by-branch upgrade notes
- Treat Microsoft 365/Office for Windows and macOS separately: Windows uses the Office security releases schedule, while the macOS fixes are specified as build 16.112.26081010.
- If you manage Office via IT tooling (update rings, policies, or patch deployments), ensure the policy allows reaching the fixed release rather than “staying behind.”
Temporary workaround (if patching is delayed)
- Reduce the chance of triggering the issue: prevent users from opening unexpected email attachments and documents.
- Block or quarantine external Office documents from unknown senders at the email gateway and/or user mailbox rules.
- Educate users briefly to report “unexpected doc” messages and avoid enabling content prompts.
What to monitor after updating
- Review email security alerts related to malicious documents and check for any Word crashes or suspicious spawning of processes after document opens.
- Confirm Office update status across endpoints (especially those that receive emails externally).

Technical context

CVE-2026-64907 is a Microsoft Office Word remote code execution issue based on a stack-based buffer overflow (CWE-121). The vulnerability is designed to be triggered by user interaction—specifically, when a victim opens a crafted Word document—allowing an unauthorized attacker to execute code locally.

Exposure indicators from the provided findings:

KEV: not listed in CISA KEV.
Public exploit code: none on record.
Predicted likelihood (EPSS): low (prediction only) and flat; however, this does not override the RED priority.
Patch availability: fixed versions are explicitly provided for Microsoft 365 apps / Microsoft Office (via Microsoft’s Office security releases) and for macOS builds (16.112.26081010).
Actor/attention: press attention tied to patching and reported association with Lazarus group.

Bottom line: this is not a “background” issue—because it targets Word and results in code execution, the practical risk is tied to whether your installed Office/Word versions are patched and whether users may open malicious documents.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS38th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 38th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 3 days, from the signal feeds we watch.

2026-08-14Patch availablerecord updated
2026-08-13OpenVAS check added
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- Microsoft 365 Apps for EnterpriseDesktop AppConsumer Software / productivity
- microsoft 365SaaS ServiceSaaSCloud & SaaS / saas-application
- office 2019Desktop AppOn-premConsumer Software / productivity
- office 2021Desktop AppOn-premConsumer Software / productivity
- office 2024Desktop AppOn-premConsumer Software / productivity
- wordDesktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC 2021Desktop AppConsumer Software / productivity
- Microsoft Office 365 for MacDesktop AppOn-premConsumer Software / productivity

And 6 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable