What is the CVSS score of CVE-2026-64911?

CVE-2026-64911 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Office are affected by CVE-2026-64911?

A heap-based buffer overflow in Microsoft Office 2019, 2021, 2024 LTSC, and Microsoft 365 Apps for Enterprise enables system compromise when users open untrusted files, with CVSS 7.8 (HIGH) severity.. A patch is available.

How to fix or mitigate CVE-2026-64911?

Within 24 hours, identify all systems running Office 2019, 2021, 2024 LTSC, or Microsoft 365 Apps for Enterprise and issue a security advisory to users prohibiting opening files from external or untrusted sources until patching is complete; within 7 days, obtain the vendor security patch and validate it in non-production test environments for compatibility with your enterprise deployments; within 30 days, complete rollout of the patch to all production systems running affected Office versions with documented tracking of completion by system and department.

Microsoft Office CVE-2026-64911

EUVD-2026-56714 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-9fmp-h9wg-v7hh

Buffer Overflow Heap Overflow Microsoft 365 Apps Microsoft 365 Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File-based delivery requires local processing (AV:L) and user interaction (UI:R); no attacker privileges needed (PR:N); full code execution yields C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:39 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 cve.org

HIGH 7.8

DescriptionCVE.org

Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution via heap-based buffer overflow in Microsoft Office affects multiple product lines including Office 2019, 2021, 2024 LTSC, and Microsoft 365 Apps for Enterprise. An integer overflow or wraparound during document parsing leads to an undersized heap allocation (CWE-122), enabling arbitrary code execution at the privilege level of the opening user when a victim opens a maliciously crafted Office file. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, though the full-triad high-impact CVSS score of 7.8 reflects the severity of successful exploitation.

Technical ContextAI

The root cause is an integer overflow or wraparound (triggering CWE-122, Heap-based Buffer Overflow) within Microsoft Office's document processing logic. An arithmetic overflow during size computation results in an undersized heap buffer being allocated; subsequent writes exceeding that allocation corrupt adjacent heap memory, a classic precondition for arbitrary code execution. The tags confirm 'Heap Overflow' and 'Buffer Overflow', indicating the integer overflow serves as the triggering condition for the downstream heap corruption. Affected CPE-identified products span Office 2019 (19.0.0+), Office LTSC 2021 (16.0.1+), Office LTSC 2024 (16.0.0+), Microsoft 365 Apps for Enterprise (16.0.1+), and their macOS counterparts including Office LTSC for Mac 2021/2024 and Office 365 for Mac - spanning both Windows and macOS platforms. The CVSS vector AV:L reflects that exploitation requires local file processing (user opens a document), not a remote network-exploitable service.

RemediationAI

Apply the vendor-released patch immediately. For macOS installations (Office LTSC for Mac 2021, LTSC for Mac 2024, Office 365 for Mac), update to build 16.112.26081010 or later via Microsoft AutoUpdate or the Mac App Store. For Windows installations (Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise), apply the latest security update as directed at https://aka.ms/OfficeSecurityReleases; no specific fixed build number is independently confirmed in the input data for Windows versions - consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64911 for exact version details. As a compensating control prior to patching, configure Protected View to open all documents from external or internet sources in read-only mode, which prevents execution of malicious payloads in many document-based attack scenarios; note that this does not eliminate the vulnerability and determined users may bypass Protected View prompts. Additionally, consider disabling macro execution and enforcing email gateway policies that block or sandbox Office document attachments. These controls reduce exposure but do not eliminate it - patching remains the only definitive remediation.