CVE-2026-64909

This vulnerability is a weakness in Microsoft Office where a specially crafted document can cause Office to behave incorrectly—and that mistake can be turned into running malicious code on the computer. Think of it like a “poisoned” form that doesn’t just crash the app; it can lead the app to hand control of the computer to an attacker when the form is opened.

This matters if your business uses Microsoft Office (including Microsoft 365 apps and Office 2016/2019/2021/2024) on Windows or macOS, especially if employees receive and open documents from email or the internet. The risk is tied to user action: you’re exposed only if an attacker can get you to open a crafted file in Office; there’s no need for the attacker to already have an account.

This is RED because the issue is capable of arbitrary code execution on the user’s machine after opening a crafted Office file, which makes it practical for targeted attacks. While no specific public incident tied to this exact CVE was found in the provided reports, the reporting indicates active actor attention (notably Lazarus group) and a newly released patch, so you should act now.

1. Identify what you run:

   • Windows: determine whether affected endpoints use “microsoft 365 apps” or “microsoft office” (and which major version/installation channel).
   • macOS: determine whether affected endpoints use “Microsoft Office 365 for Mac”, “Microsoft Office LTSC for Mac 2021”, or “Microsoft Office LTSC for Mac 2024”.

2. Check your installed version:

   • In Office, go to the app’s About page to see the full version number.
   • Record the version for each device so you can verify it after updating.

3. Apply the specific Microsoft fixes:

   • Windows — “microsoft office”: upgrade to 16.0.5565.1001.
   • Windows — “microsoft 365 apps”: install the update(s) from Microsoft’s Office security releases page for this CVE (use the linked Microsoft guidance for CVE-2026-64909).
   • macOS: update to 16.112.26081010 (applies to Microsoft Office 365 for Mac and both LTSC for Mac variants listed).

4. Verify after patching:

   • Re-check the About/version screen to confirm each endpoint shows a version at or beyond the fixed versions above.

5. If patching is delayed (temporary workaround):

   • Immediately reduce exposure to “opened by mistake” files: block or quarantine unexpected Office attachments, warn staff not to open unsolicited documents, and limit use of unknown USB media/shares.
   • If you use email gateway filtering or web filtering, increase strictness for Office file types until devices are updated.

6. What to monitor:

   • Look for Office crashes or unusual Office process behavior around the time a suspicious document was opened.
   • Review endpoint security logs for signs of new processes spawned from Office applications, unexpected network connections, or persistence changes.

Severity is high (CVSS 7.8) with local attack conditions: no attacker authentication is required, but user interaction is required (a user must open a crafted document). The weakness involves integer handling in Microsoft Office (including integer underflow/wraparound), which can be turned into a crash or, in the worst case, arbitrary code execution on the victim machine.

From the provided findings: there is no entry in the CISA KEV list for this CVE, no public exploit code is noted, and no dated press report of exploitation for this exact CVE was provided. However, actor attention is indicated (Lazarus group) and a new Microsoft patch is available; KEV was not listed, so exploitation status is not confirmed by KEV/news in the provided sources. EPSS is provided only as a prediction (and is not used to claim real-world exploitation).