What is the CVSS score of CVE-2026-64915?

CVE-2026-64915 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Office Word are affected by CVE-2026-64915?

CVE-2026-64915 affects Microsoft Office Word across multiple enterprise versions (2019, Microsoft 365 Apps, LTSC 2021/2024, Word 2016, and Mac editions), enabling code execution when users open…. A patch is available.

How to fix or mitigate CVE-2026-64915?

Within 24 hours, confirm patch availability from Microsoft Security Advisories and inventory all affected Office versions in your enterprise to establish a deployment roadmap by business criticality and user roles. Over the next 7 days, obtain and validate the patch in a test environment with your enterprise applications, document any compatibility issues, and communicate the deployment timeline to end-user management and security stakeholders. Complete patch deployment across your organization within 30 days, prioritizing finance, legal, and executive users first, then rolling out to general user populations, and verify compliance through endpoint management telemetry.

Microsoft Office Word CVE-2026-64915

EUVD-2026-56717 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-7r87-rqc6-m6vh

Buffer Overflow Heap Overflow Microsoft 365 Apps Word Microsoft 365 Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

vuln.today AI

7.8 HIGH

Local file-based attack with mandatory user interaction and no privilege requirement; full C/I/A impact reflects arbitrary code execution in user context.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:37 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

AnalysisAI

Heap-based buffer overflow in Microsoft Office Word enables local code execution with High confidentiality, integrity, and availability impact when a user opens a specially crafted document. Affects Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Word 2016, and corresponding Mac editions. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the broad product footprint and low attack complexity make patch application a near-term priority for enterprise defenders.

Technical ContextAI

CWE-122 (Heap-based Buffer Overflow) describes a class of memory-safety defect where a program writes beyond the boundaries of a heap-allocated buffer, corrupting adjacent memory structures. In the context of Microsoft Word's document-parsing subsystem, a malformed or specially crafted document can trigger this overflow during processing of Word-format (.doc/.docx) data. The CVSS vector AV:L reflects that the attacker-controlled input reaches the vulnerable parser via a locally accessible file (whether delivered via email attachment, USB, network share, or download). Affected CPE artifacts span multiple Office generations on both Windows and macOS platforms, indicating the vulnerable code path exists across the shared Office rendering engine. The CWE-122 root cause class is historically exploitable for arbitrary code execution by overwriting heap metadata or adjacent function pointers.

RemediationAI

Primary remediation is to apply the vendor-released patch immediately via Microsoft Update or Microsoft 365 Admin Center. For Windows Office 2019, LTSC 2021, LTSC 2024, and 365 Apps for Enterprise, apply the latest cumulative update referenced at https://aka.ms/OfficeSecurityReleases. For Microsoft Word 2016 on Windows, update to version 16.0.5565.1000 or later. For Mac editions (Office 365 for Mac, LTSC for Mac 2021, LTSC for Mac 2024), update to version 16.112.26081010 or later. Where patching is not immediately possible, organizations should consider disabling automatic opening of Word documents from untrusted sources using Protected View policies, enforcing attack surface reduction (ASR) rules via Microsoft Defender to block Office applications from creating child processes, and restricting macro execution. Note that ASR rules and Protected View reduce exploitability but do not eliminate the underlying vulnerability - they are compensating controls only.