EUVD-2026-56714
GHSA-9fmp-h9wg-v7hh
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-based delivery requires local processing (AV:L) and user interaction (UI:R); no attacker privileges needed (PR:N); full code execution yields C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution via heap-based buffer overflow in Microsoft Office affects multiple product lines including Office 2019, 2021, 2024 LTSC, and Microsoft 365 Apps for Enterprise. An integer overflow or wraparound during document parsing leads to an undersized heap allocation (CWE-122), enabling arbitrary code execution at the privilege level of the opening user when a victim opens a maliciously crafted Office file. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, though the full-triad high-impact CVSS score of 7.8 reflects the severity of successful exploitation.
Technical ContextAI
The root cause is an integer overflow or wraparound (triggering CWE-122, Heap-based Buffer Overflow) within Microsoft Office's document processing logic. An arithmetic overflow during size computation results in an undersized heap buffer being allocated; subsequent writes exceeding that allocation corrupt adjacent heap memory, a classic precondition for arbitrary code execution. The tags confirm 'Heap Overflow' and 'Buffer Overflow', indicating the integer overflow serves as the triggering condition for the downstream heap corruption. Affected CPE-identified products span Office 2019 (19.0.0+), Office LTSC 2021 (16.0.1+), Office LTSC 2024 (16.0.0+), Microsoft 365 Apps for Enterprise (16.0.1+), and their macOS counterparts including Office LTSC for Mac 2021/2024 and Office 365 for Mac - spanning both Windows and macOS platforms. The CVSS vector AV:L reflects that exploitation requires local file processing (user opens a document), not a remote network-exploitable service.
RemediationAI
Apply the vendor-released patch immediately. For macOS installations (Office LTSC for Mac 2021, LTSC for Mac 2024, Office 365 for Mac), update to build 16.112.26081010 or later via Microsoft AutoUpdate or the Mac App Store. For Windows installations (Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise), apply the latest security update as directed at https://aka.ms/OfficeSecurityReleases; no specific fixed build number is independently confirmed in the input data for Windows versions - consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64911 for exact version details. As a compensating control prior to patching, configure Protected View to open all documents from external or internet sources in read-only mode, which prevents execution of malicious payloads in many document-based attack scenarios; note that this does not eliminate the vulnerability and determined users may bypass Protected View prompts. Additionally, consider disabling macro execution and enforcing email gateway policies that block or sandbox Office document attachments. These controls reduce exposure but do not eliminate it - patching remains the only definitive remediation.
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted input
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today