What is the CVSS score of CVE-2026-64904?

CVE-2026-64904 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Office are affected by CVE-2026-64904?

Microsoft Office products (2019, LTSC 2021/2024, and 365 Apps for Enterprise) are vulnerable to remote code execution through type confusion when users open maliciously crafted files, affecting…. A patch is available.

How to fix or mitigate CVE-2026-64904?

Within 24 hours, inventory all systems running Microsoft Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise across Windows and macOS platforms, and establish a patch testing environment. Within 7 days, deploy vendor-released patches to all identified systems through your standard change management process, prioritizing end users in high-risk functions (finance, executive staff, administrative roles). Within 30 days, confirm complete patch coverage across all affected Office installations through endpoint compliance scanning, document patching in your asset management system, and deliver targeted security awareness training on phishing threats and safe document handling practices.

Microsoft Office CVE-2026-64904

EUVD-2026-56707 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-08-11 secure@microsoft.com

GHSA-8hf2-fghf-qjf2

Authentication Bypass Memory Corruption Microsoft 365 Apps Microsoft 365 Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector confirmed by document-open trigger; PR:N because no system account needed; UI:R mandatory; full C/I/A loss from code execution.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:44 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Type confusion (CWE-843) in Microsoft Office enables local code execution across multiple Office product lines when a user opens a crafted file. Affected versions span Microsoft Office 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise on both Windows and macOS. With high confidentiality, integrity, and availability impact and user-interaction-only as the sole prerequisite, the vulnerability presents meaningful risk in phishing and malicious-document delivery scenarios. No public exploit identified at time of analysis, though a vendor patch is available.

Technical ContextAI

CWE-843 (Type Confusion) occurs when a program allocates or initializes a resource as one type but subsequently accesses it as a different, incompatible type, leading to memory corruption. In Microsoft Office, this class of flaw typically manifests in document parsing logic - Office processes complex binary or XML-based file formats (e.g., .docx, .xls, .ppt) where type metadata governs how memory regions are interpreted. A crafted document can supply mismatched type indicators, causing the Office runtime to dereference a pointer or invoke virtual methods against the wrong object layout. The tag 'Memory Corruption' corroborates this: type confusion in managed or native Office code frequently leads to heap corruption, which is a reliable code execution primitive. Affected CPE-equivalent products span Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and their macOS counterparts (Office LTSC for Mac 2021/2024, Office 365 for Mac), per EUVD-2026-56707.

RemediationAI

The primary remediation is to apply the vendor-released patch via Microsoft Update or the Office release channel documented at https://aka.ms/OfficeSecurityReleases; macOS users should update to build 16.112.26081010 or later. Organizations using Microsoft 365 Apps for Enterprise on Click-to-Run should ensure automatic updates are enabled and confirm build levels via the Office Deployment Tool or Intune compliance policies. As a compensating control pending patching, enabling Protected View for files originating from the internet or email attachments (File > Options > Trust Center > Protected View) directly limits the attack surface by sandboxing document rendering before any parsing-intensive code runs - the trade-off is that users must explicitly enable editing for legitimate files. Additionally, disabling or restricting Office macros and Dynamic Data Exchange (DDE) via Group Policy reduces the post-exploitation attack surface even if the type confusion flaw itself is triggered. No workaround fully replaces the patch, as the flaw is in core parsing logic.