What is the CVSS score of EUVD-2026-56701?

EUVD-2026-56701 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft Office are affected by EUVD-2026-56701?

A critical vulnerability in Microsoft Office (CVE-2026-64898) affects Windows and macOS users across all editions from Office 2019 through Microsoft 365, allowing arbitrary code execution when…. A patch is available.

How to fix or mitigate EUVD-2026-56701?

Within 24 hours, conduct an inventory of all Microsoft Office installations across Windows and macOS, including Office 2019, Office LTSC 2021/2024, and Microsoft 365 Apps for Enterprise, and establish patching timelines prioritizing mission-critical systems and high-risk departments. Within 7 days, deploy the vendor-released patch to all Office installations, beginning with executives, finance, legal, and external-facing departments whose document exposure is highest. Within 30 days, achieve comprehensive patching across all remaining Office deployments, and implement concurrent security awareness training to educate users on document source verification and suspicious document reporting procedures.

Microsoft Office EUVD-2026-56701

| CVE-2026-64898 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-v8rw-p6qg-h7qx

Buffer Overflow Heap Overflow Microsoft 365 Apps Microsoft 365 Office 2021 Office 2024 Office 2019

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector with mandatory user interaction to open the crafted file; no target-system privileges needed as attacker delivers the file externally via phishing.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:47 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Office affects all major editions across Windows and macOS, including Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019, and their Mac counterparts. The vulnerability is a heap-based buffer overflow (CWE-122) triggered when a user opens a specially crafted document, granting the attacker arbitrary code execution at the victim's privilege level. No public exploit has been identified at time of analysis, and a vendor-released patch is available, making this a high-priority patching target across enterprise Office deployments.

Technical ContextAI

CWE-122 (Heap-based Buffer Overflow) describes a memory corruption class where data written to a heap-allocated buffer exceeds its allocated bounds, corrupting adjacent heap memory and enabling attacker-controlled execution flow. In Microsoft Office, this class of flaw typically resides in document parsing components - such as parsers for .docx, .xlsx, .pptx, or legacy binary formats - where malformed input drives a write beyond the buffer boundary. The fact that affected products span both Windows (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019) and macOS (Office 365 for Mac, Office LTSC for Mac 2021/2024) strongly suggests the vulnerable component is part of a shared cross-platform parsing library rather than a platform-specific subsystem. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only that the victim open the malicious file locally, with no system privileges required of the attacker.

RemediationAI

Apply the vendor-released patch immediately via Microsoft Update, the Microsoft Update Catalog, or Microsoft AutoUpdate on macOS. For macOS editions, the patched build is confirmed as 16.112.26081010 - update through Microsoft AutoUpdate or the Mac App Store where applicable. For Windows editions (Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2019), exact patched build numbers are not specified in the available data; consult https://aka.ms/OfficeSecurityReleases and the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64898 for confirmed fixed versions. As interim compensating controls prior to patching: block inbound delivery of Office documents from untrusted external sources at the email gateway (trade-off: may interrupt legitimate business document workflows, requiring trusted-sender exceptions); enable Microsoft Defender Attack Surface Reduction rules that block Office applications from spawning child processes; and enforce Protected View for files originating from the internet or email, which prevents automatic code execution on open. Protected View adds a user confirmation step that meaningfully raises the exploitation bar without blocking file access.