CVE-2026-64911

This flaw is in Microsoft Office and can be triggered when someone gets a user to open a specially made Office file. Once opened, it can allow harmful code to run on the computer, similar to how a booby-trapped document could run malware as soon as you view it.

This matters if your business uses Microsoft Office (including Microsoft 365 Apps, Microsoft 365, Office 2019/2021/2024, and Microsoft Office on macOS: Microsoft Office 365 for Mac and the LTSC for Mac 2021/2024). It primarily becomes a real risk when an attacker can persuade a user to open a malicious Office document, since the weakness is triggered through Office file usage.

Reachability gate: treat it as a concern if staff open Office files received via email, downloads, or other external sources.

This is RED because Office is widely used and this issue is specifically a code-execution flaw triggered by malicious document handling. The current information also shows actor-linked press attention (Lazarus group) and a patch is available, so there’s no reason to delay updating.

1. Inventory what you run: identify every Office product and platform in use (Windows: Microsoft 365 Apps / Microsoft Office; macOS: Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024).

2. Check versions:

• Windows (Microsoft 365 Apps / Microsoft Office): open Office → Account (or File → Account) and record the installed version/build.
• macOS: open Microsoft Office → About and record the build number.

3. Compare to fixed versions:

• Microsoft Office for Mac: fixed in 16.112.26081010 (also applies to LTSC for Mac 2021 and LTSC for Mac 2024).
• Microsoft 365 Apps and Microsoft Office (Windows): apply the updates from Microsoft’s Office security releases page for CVE-2026-64911 (see the vendor remediation page and linked security releases).

4. Upgrade path:

• Update to the fixed versions above; if you’re on an older branch, move to the newest available security update stream that includes the fixed build.
• Plan a brief application restart after updates and re-check Office “About” to confirm the new build is installed.

5. If you can’t patch immediately (workaround):

• Temporarily tighten controls around opening email attachments and downloaded Office files (especially from unexpected senders).
• If your organization has them, prioritize enabling/strengthening email security filters that quarantine Office attachments and block known-bad file indicators.
• Instruct staff not to open unexpected Office documents and to report them immediately.

6. Monitor after patching:

• Review endpoint security/EDR alerts related to Office document execution or unexpected child processes from Office applications.
• Keep an eye out for unusual Office behavior (unexpected macros/scripts, suspicious network connections) on endpoints that used external Office documents before the update.

CVE-2026-64911 is a Microsoft Office vulnerability classified under CWE-122 and CWE-190, where an integer overflow/wraparound condition can lead to unintended code execution when handling a crafted Office file. The reported impact is local code execution in the context of Office file usage (attack complexity low), and the availability of security fixes indicates vendor remediation is straightforward.

Exploitation status: no public exploit code is on record, and it is not listed in CISA KEV. However, press attention notes a patch and references actor-linked activity (Lazarus group), so assume real-world interest and prioritize updating.

KEV meaning (here): KEV would indicate confirmed exploitation tracked by CISA; since it is not listed, exploitation is not confirmed by KEV at the time of these findings.

EPSS: provided as a prediction and its exact value should not be used for decision-making; the operational decision here is driven by the RED verdict and the availability of fixed releases.