What is the CVSS score of CVE-2026-64909?

CVE-2026-64909 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Office are affected by CVE-2026-64909?

Microsoft Office installations across enterprise environments-including Microsoft 365 Apps for Enterprise and LTSC releases (2024, 2021, 2019, 2016) on both Windows and Mac-are vulnerable to…. A patch is available.

How to fix or mitigate CVE-2026-64909?

Within 24 hours, identify all Microsoft Office deployments across the organization including Microsoft 365 Apps for Enterprise, Office LTSC 2024, 2021, 2019, and 2016 on Windows and Mac, and assess which systems are connected to patch management infrastructure. Within 7 days, deploy the Microsoft Security Response Center vendor patch to all identified Office installations using your standard patch management process, prioritizing systems used for sensitive work. Within 30 days, complete patch verification across the entire Office footprint and implement additional monitoring for document-based exploit attempts, including suspicious macros or embedded content in Office files.

Microsoft Office CVE-2026-64909

EUVD-2026-56711 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-vf46-2j82-3mjw

Buffer Overflow Heap Overflow Microsoft 365 Apps Microsoft 365 Office 2021 Office 2024 Office 2019 Office 2016

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-based trigger (AV:L), user must open crafted document (UI:R), no attacker privileges needed (PR:N), full triad impact via code execution.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:41 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Heap-based buffer overflow in Microsoft Office, rooted in an integer underflow during document parsing, enables local code execution with high confidentiality, integrity, and availability impact when a user opens a specially crafted file. All major Office release channels on both Windows and Mac are affected, including Microsoft 365 Apps for Enterprise, Office LTSC 2024/2021/2019/2016, and their Mac equivalents. No public exploit has been identified at time of analysis, but a vendor-released patch is available via the Microsoft Security Response Center.

Technical ContextAI

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow), triggered by an integer underflow (wrap or wraparound) - a condition where a signed or unsigned integer decrements below its minimum representable value, wrapping to a large positive number. In a document-parsing context this commonly manifests as an undersized heap allocation: the integer underflow produces a buffer length that is smaller than expected, and subsequent write operations overflow the allocated heap region. Tags confirm the dual nature: 'Heap Overflow' and 'Buffer Overflow' are both present, consistent with an integer underflow being the root cause and heap corruption being the exploitable consequence. Affected CPE-equivalent products span Office 16.x builds on Windows (Microsoft 365 Apps for Enterprise, LTSC 2024, LTSC 2021, Office 2016 through build 16.0.5565.1001) and Office 16.x builds on Mac (LTSC for Mac 2024, LTSC for Mac 2021, Office 365 for Mac - all below build 16.112.26081010), as well as Office 2019 (19.0.x channel). The CVSS attack vector AV:L with UI:R indicates the overflow is triggered through the Office document-parsing pipeline when a user opens a crafted file.

RemediationAI

The primary remediation is to apply the vendor-released patch via Microsoft Update or the Office deployment tooling. For Windows Office channels (Microsoft 365 Apps for Enterprise, LTSC 2024, LTSC 2021, Office 2019), update to the latest build as directed at https://aka.ms/OfficeSecurityReleases. For Office 2016 on Windows, update to build 16.0.5565.1001 or later. For Mac channels (Office 365 for Mac, LTSC for Mac 2021, LTSC for Mac 2024), update to build 16.112.26081010 or later. The full advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64909. Where immediate patching is not feasible, compensating controls include enabling Protected View for documents received from the internet or email attachments (already a default in many configurations), which prevents automatic full parsing of untrusted files. Additionally, deploying attack surface reduction (ASR) rules via Microsoft Defender to block Office applications from creating child processes reduces post-exploitation impact. Note that Protected View bypass techniques exist, so these are mitigations only - patching remains the definitive fix.