CVE-2026-66807

Microsoft Office Graphics Component Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 38th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile38th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-14Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which Microsoft Office product and exact version your company uses (including Windows Microsoft 365/Office and any Mac Microsoft Office versions).
Verify whether you are already on the fixed versions listed by Microsoft—on Mac, confirm you are at 16.112.26081010.
Update Microsoft Office using Microsoft’s Office security update guidance (see the Microsoft Office Security Releases / the CVE’s update guide) so you move to the fixed builds.
Until you finish updating, reduce risk by blocking or quarantining unexpected Office attachments from email and only opening files from trusted sources.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

This Microsoft Office graphics feature has a memory bug that can let an attacker run code when a specially crafted Office file is opened; most small businesses should update Office right away, especially if staff open emailed attachments or files from outside the company.

CVE-2026-66807 is a stack-based buffer overflow in the Microsoft Office Graphics component that can be triggered when a user opens a malicious Office document, potentially enabling local remote code execution (with user interaction) in Microsoft Office/ Microsoft 365 apps and the listed Mac Office editions.

If you're affected

Office takeover
Malware execution on PCs
Business interruption
Data theft risk

What is it

Think of this like a flaw in a “picture-handling” part of Office. If someone sends a specially made file, Office can stumble over it and potentially allow harmful code to run on the computer when the file is opened—similar to opening a dangerous document that includes a hidden payload.

Who is affected

This affects common Microsoft Office and Microsoft 365 desktop apps, including Windows Office/Microsoft 365 apps and several Microsoft Office LTSC and Office 365 for Mac editions. It matters most to you if your staff regularly open Office files from email, messaging apps, or external sources (because user interaction is required). The risk is tied to whether the affected Office version is reachable by opening a malicious Office document on the user’s device.

How urgent is it

This is being treated as urgent because Microsoft has released fixes and press attention points to active targeting by a major threat actor (Lazarus group). Even without a confirmed publicly available exploit, this type of Office bug is typically delivered through crafted documents, so patching is the practical protection for most small businesses.

What to do — in detail

Inventory what you run
- Identify every endpoint that has any of the affected products installed: microsoft 365 apps, microsoft 365, office 2019, office 2021, office 2024, office variants listed above, and any Mac equivalents (Microsoft Office 365 for Mac; Microsoft Office LTSC for Mac 2021/2024).
- Record the exact Office version/build for each device.
Check whether you’re already fixed
- For Microsoft Office for Mac / LTSC for Mac: Microsoft reports the fixed version as 16.112.26081010.
- For Windows / other listed Microsoft Office editions: use Microsoft’s Office Security Releases and the CVE’s Microsoft update guide to confirm the fixed build for your specific product/branch, because the findings did not provide exact Windows version numbers.
Patch (the actual fix)
- Apply the Microsoft Office security updates as directed by Microsoft:
  - Use https://aka.ms/OfficeSecurityReleases to move the affected Office installs to the fixed builds.
  - Use https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66807 to confirm the correct update path for the specific Office product you have.
- On Mac devices, ensure the Office build is updated to 16.112.26081010.
If patching will be delayed
- Temporarily reduce exposure by restricting how Office files arrive:
  - Quarantine or block unexpected Office attachments (especially emails from new/unknown senders).
  - Encourage “verify before opening” for external files, and avoid opening macros/attachments from untrusted sources.
- This does not replace patching, but it lowers the chance someone will open a malicious document.
After updating: verify
- Re-check the Office version/build on each endpoint.
- Confirm Microsoft Update (or your device management system) is set to install Office security updates.
What to monitor
- Watch for security detections related to Office processes spawning unexpected programs or unusual child processes right after Office is opened.
- Monitor your email gateway for repeated attempts sending Office attachments that could be using this issue.

Technical context

CVE-2026-66807 is classified under CWE-121, indicating a stack-based buffer overflow. The vulnerability is in the Microsoft Office Graphics component and can be triggered when processing a crafted document; the provided scoring indicates it requires user interaction (the user must open the file). Based on the findings: there is no KEV entry and no public exploit code on record; exploitation is not confirmed via KEV here. However, press attention notes a patch and an actor connection (Lazarus group), and Microsoft has published fixed versions (including specific Mac build 16.112.26081010). The fix is available via Microsoft’s Office Security Releases and the CVE’s Microsoft security update guide.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS38th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 38th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 3 days, from the signal feeds we watch.

2026-08-14Patch availablerecord updated
2026-08-13OpenVAS check added
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- Microsoft 365 Apps for EnterpriseDesktop AppConsumer Software / productivity
- microsoft 365SaaS ServiceSaaSCloud & SaaS / saas-application
- office 2019Desktop AppOn-premConsumer Software / productivity
- office 2021Desktop AppOn-premConsumer Software / productivity
- office 2024Desktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC 2021Desktop AppConsumer Software / productivity
- Microsoft Office 365 for MacDesktop AppOn-premConsumer Software / productivity
- Microsoft Office LTSC for Mac 2021Desktop AppOn-premConsumer Software / productivity

And 4 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable