CVE-2026-65664

Microsoft Office Graphics Component Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 38th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile38th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-14Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which Microsoft Office product you’re using (Microsoft 365 Apps, Office 2019/2021/2024, or Office for Mac variants) and the installed version/build.
Compare your current Office version/build against the fixed versions listed on the Microsoft update guide for CVE-2026-65664.
Update immediately to the fixed release: for Microsoft Office for Mac, upgrade to 16.112.26081010; for Windows/Microsoft 365 Apps and Microsoft Office, install the security update(s) provided on the Office security releases page.
After updating, restart Office and confirm the new version/build shows in the Office “About” screen.
If you cannot update right away, restrict access to untrusted documents and disable opening of files from email links until patching is completed (temporary risk reduction).

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

CVE-2026-65664 is a Microsoft Office bug that can let an attacker run code on your computer after you open a specially made file; if you use Office, you should update now because this is a high-risk issue even if it’s not confirmed to be widely exploited.

CVE-2026-65664 is a heap-based buffer overflow in Microsoft Office graphics handling that can lead to local remote-code-execution after a user opens a malicious document image payload; patch updates are available for multiple Microsoft Office and Microsoft 365 products.

If you're affected

Compromised workstation
Malware installation
Ransomware risk
Data theft risk

What is it

This vulnerability is in how Microsoft Office handles certain graphics content. If someone sends you an Office file with a specially crafted “graphics” part and you open it, the bug can let code run on your computer. Think of it like a “malicious picture inside a document” that Office fails to safely process.

Who is affected

This matters if your business uses Microsoft 365 Apps, Microsoft Office (Office 2019/2021/2024), or any of the listed Microsoft Office for Mac / LTSC for Mac versions. It’s a risk when an attacker can get you to open a malicious Office file (it requires user interaction like opening the file). It’s not a general background vulnerability that triggers just by having Office installed.

How urgent is it

This should be treated as urgent because attackers have shown interest (Lazarus group referenced in the reporting) and Office vulnerabilities can be quickly weaponized through email attachments. Your fastest protection is to apply the vendor’s fixed releases now, since a user opening a malicious file is enough to trigger the problem. The current tracking does not list this in the CISA KEV set, but that does not reduce the need to patch.

What to do — in detail

Confirm exposure
- Windows / Microsoft 365 Apps / Microsoft Office: In any Office app, open the account/about page to identify your product and version/build. Match what you have (Microsoft 365 Apps vs “Microsoft Office” plus the exact version).
- macOS (Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024): Open an Office app (Word/Excel) → “About” to see the version/build.
Determine whether you need the fix
- For the listed Mac products, the fix is explicitly stated as version 16.112.26081010. If your Mac build is older than 16.112.26081010, you are considered at risk.
- For Microsoft 365 Apps and Microsoft Office, follow Microsoft’s CVE-specific update guidance and deploy the security updates linked from the Office security releases page for CVE-2026-65664.
Apply the fix
- macOS: Upgrade Office to 16.112.26081010.
- Windows: Install the security update(s) provided by Microsoft for CVE-2026-65664 from the Office security releases / update guide links.
Verification
- After updating, confirm the Office version/build in the “About” screen shows the fixed version (Mac: 16.112.26081010) and that Office apps restart cleanly.
Temporary workaround if patching is delayed
- Reduce the chance of opening malicious documents: avoid opening unexpected Office attachments, especially those received via email or chat links.
- If your organization has controls for untrusted file types or macro/script-like content, tighten them for Office documents until the patch is applied.
What to monitor
- Look for alerts from your endpoint protection and email security for Office document exploits around the time employees received/opened suspicious files.
- Monitor for unusual Office behavior on endpoints (unexpected process launches shortly after opening a document) as a practical safety net while you patch.

Technical context

CVE-2026-65664 is a Microsoft Office heap-based buffer overflow (CWE-122) tied to the Office graphics component. The risk is triggered when a user opens a malicious Office file containing a crafted graphics payload; the vulnerability can allow local execution of attacker-controlled code (remote code execution in the context of the affected machine). No CISA KEV listing was found, and no public exploit code is on record in the provided findings; however, reporting notes press attention referencing the Lazarus group, which supports treating this as high priority. Fixes are available via Microsoft’s Office security release guidance (Windows products via the linked update guide; macOS products specifically fixed at version 16.112.26081010). The provided CVSS score is 7.8 (High), with a vector indicating the attacker does not need privileges beforehand and requires user interaction.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS38th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 38th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 3 days, from the signal feeds we watch.

2026-08-14Patch availablerecord updated
2026-08-13OpenVAS check added
2026-08-12Record updatedrecord updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- Microsoft 365 Apps for EnterpriseDesktop AppConsumer Software / productivity
- microsoft 365SaaS ServiceSaaSCloud & SaaS / saas-application
- office 2019Desktop AppOn-premConsumer Software / productivity
- office 2021Desktop AppOn-premConsumer Software / productivity
- office 2024Desktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC 2021Desktop AppConsumer Software / productivity
- Microsoft Office 365 for MacDesktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC for Mac 2021Desktop AppOn-premConsumer Software / productivity

And 4 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable