CVE-2026-65657

This vulnerability is like a “memory bookkeeping” mistake inside Microsoft Office. Under certain document conditions, Office can end up using freed memory in a way that lets an attacker run their own code on your device when you open the document. In a business setting, that can turn a malicious email attachment into a serious malware infection.

This matters if your business uses Microsoft Office (including Microsoft 365 Apps and the listed Office/macOS editions). Because the issue can be triggered by opening a crafted document, it creates risk around phishing and “unexpected attachment” scenarios. Act urgently if your Office is not yet updated to the fixed versions, especially when documents are frequently opened from email or the web.

This is RED because it is a high-impact remote code execution class bug in Microsoft Office and Microsoft has provided fixes across multiple Office editions. Even though there’s no public exploit code listed in the findings, press attention tied to the patch indicates active, real-world attacker focus (including Lazarus-group mentions). Update now rather than waiting for “later this week.”

1. Confirm exposure (quick check)

   • Identify the exact Microsoft Office product and edition you run (Windows vs macOS, and which licensing line you’re on).
   • On Windows, check the Office build/version in Office account/about screens.
   • On macOS, check the Office version/build in the Microsoft Office app’s “About” dialog.

2. Determine whether you are on a fixed version

   • For Microsoft 365 Apps: fixed via the Microsoft Office security release process listed at https://aka.ms/OfficeSecurityReleases.
   • For microsoft office: fixed via the same Microsoft Office security release process listed at https://aka.ms/OfficeSecurityReleases.
   • For Microsoft Office 365 for Mac / Microsoft Office LTSC for Mac 2021 / Microsoft Office LTSC for Mac 2024: fixed in 16.112.26081010.

3. Upgrade/patch

   • Install the update(s) provided by Microsoft for CVE-2026-65657 using the Office security releases page(s) above (Windows and Microsoft 365 Apps / microsoft office).
   • On macOS, update to Office version 16.112.26081010.
   • If your organization uses managed update channels, confirm the update is deployed to all endpoints that have Office installed (not just a subset).

4. If patching is delayed (temporary containment)

   • Treat email/web documents as untrusted until updated, especially unexpected attachments.
   • Keep users on the safest handling path (for example: avoid opening unexpected Office files; open documents only after verifying the sender and content).
   • Make sure protected viewing / safety features are enabled in Office and that users understand not to “enable content” or open suspicious files.

5. Validate after updating

   • Re-check the Office version/build on affected macOS endpoints (must be 16.112.26081010 for the macOS editions listed in the findings).
   • For Windows/other editions, confirm the installed build aligns with the Microsoft Office security releases for CVE-2026-65657.

6. What to monitor

   • Look for repeated user reports of suspicious Office document activity.
   • Monitor endpoint security alerts for Office spawning unexpected processes or unusual child processes shortly after Office is opened.

CVE-2026-65657 is a Microsoft Office vulnerability (CWE-416: use-after-free) with a reported CVSS of 7.8 (HIGH). The attack goal is remote code execution on the local machine when a user interacts with a crafted document; the findings indicate user interaction is required (UI:R) while no valid prior credentials are required (PR:N). KEV is not listed in CISA KEV and there is no public exploit code on record in the findings, but press attention tied to the patch (including Lazarus-group mentions) increases urgency. The reported EPSS is a low predicted likelihood (and remains a prediction only); the key remediation driver here is the confirmed availability of fixed versions from Microsoft and the high severity of the vulnerability class.