What is the CVSS score of CVE-2026-64905?

CVE-2026-64905 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Office Word are affected by CVE-2026-64905?

Microsoft Office Word contains a high-severity vulnerability (CVE-2026-64905) allowing arbitrary code execution when users open specially-crafted documents on Windows and Mac systems.. A patch is available.

How to fix or mitigate CVE-2026-64905?

Within 24 hours, inventory all Microsoft Office Word installations across your Windows and Mac environments and communicate patch availability to IT leadership for emergency deployment planning. Within 7 days, complete vendor patch validation in a test environment and deploy the released patch to all endpoints, with immediate priority for business-critical systems and user-facing staff. Within 30 days, confirm patch deployment across all systems using your endpoint management tools, establish monitoring for exploitation attempts targeting this CVE, and conduct spot-checks on high-risk user groups.

Microsoft Office Word CVE-2026-64905

EUVD-2026-56708 HIGH

Buffer Over-read (CWE-126)

2026-08-11 secure@microsoft.com

GHSA-6hjh-h637-rp4m

Buffer Overflow Microsoft 365 Apps Word Microsoft 365 Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

vuln.today AI

7.8 HIGH

Local vector confirmed by document-open exploitation model; PR:N because attacker needs no system privileges, only ability to deliver the file; UI:R because victim must open the document; full CIA impact from code execution.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:42 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to execute code locally.

AnalysisAI

Code execution via buffer over-read in Microsoft Office Word affects multiple Windows and Mac Office product lines when a user opens a specially crafted document. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms this is a local exploitation scenario requiring user interaction - consistent with a malicious document delivery attack - yielding full confidentiality, integrity, and availability impact on the affected system. No special privileges are required from the attacker. No public exploit code or CISA KEV listing was identified in the provided intelligence at time of analysis.

Technical ContextAI

CWE-126 (Buffer Over-Read) describes a condition where software reads data past the end of an intended buffer, which can expose sensitive memory contents or, in this case, lead to code execution if the over-read data influences control flow or memory corruption. The flaw resides in Microsoft Office Word's document parsing subsystem. Affected products span both Windows (Word 2016 through Office LTSC 2024) and macOS (Office LTSC for Mac 2021, Office LTSC for Mac 2024, Office 365 for Mac) with version ranges confirmed via ENISA EUVD-2026-56708. The attack surface is the document rendering/parsing layer, which is exposed whenever a user opens any Word-format file.

RemediationAI

Apply the vendor-released patch immediately via Microsoft Update or the Office update mechanism. For Word 2016 on Windows, update to version 16.0.5565.1000 or later. For Office 365 for Mac and Office LTSC for Mac variants, update to 16.112.26081010 or later. For Microsoft 365 Apps for Enterprise, Office LTSC 2021, Office LTSC 2024, and Office 2019 on Windows, apply the latest update as directed at https://aka.ms/OfficeSecurityReleases. The full MSRC advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64905. If patching is delayed, compensating controls include: configuring Protected View in Office to sandbox documents opened from email attachments or downloaded from the internet (reducing UI:R exploitation success without impeding most legitimate workflows); deploying Attack Surface Reduction (ASR) rules via Microsoft Defender to block Office applications from creating child processes; and training users to avoid opening unsolicited or unexpected Word documents.